{ "Event": { "published": true, "date": "2025-12-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-25", "timestamp": 1766707381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8915613f-4d9a-4305-97b0-177bfbd42746", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62ea005-e1bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766687369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687369, "uuid": "4f481849-85ee-418f-b879-5c40405faef4", "comment": "Malware payload (Mirai)", "value": "5b23ef9af502b6fa0e3ee57244e6d24d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687369, "uuid": "d96e032b-3b53-4bbd-b01e-4d80ac5eaeb8", "comment": "Malware payload (Mirai)", "value": "00740328f506a24c253f82c938489e89ab6bdd78a5fe2226d92607e802272445", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687369, "uuid": "ddec134b-3935-4feb-9f42-38f868e136d8", "comment": "Malware payload (Mirai)", "value": "e7b7323f78f0129a635a9e7a8aa49f5f6b84bcbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687369, "uuid": "8fe1bcda-d5ff-4a8f-858d-4a60ec55d430", "comment": "Malware payload (Mirai)", "value": "8bd2b357ffa3061b8ae5cbce978f4d6b5fcf2cbbf1f3ea0acb5b2fc0e46734a502150ac21c4f94fced4f15dbb85259f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687369, "uuid": "a14250b3-2a4c-4aa5-a370-344ac7ac4220", "value": "T1EB83D759F9828503C4D916FBBA1E119D330627A8F2EE3312CD305B24778AB6B0F77A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687369, "uuid": "3b842569-038b-449c-a2f0-60d6cb3c515e", "value": "1536:qVnS5a0H8aYDDN5YEPfiChFULyG8QViNWTrLEI/iydBriH6:C0miufiCPULylYdBriH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766687369, "uuid": "da2a5ce0-4347-40b2-8249-0a7cae7ce7ef", "value": 82304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766687369, "uuid": "9d0dc1aa-3bdc-4efa-aa70-c4c72e05397b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687369, "uuid": "48eef5c1-9569-4e2b-8cca-a2d188dda28f", "value": "shadow.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae9dd92-e132-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626683, "uuid": "605e60d1-64c7-4a2a-87b5-dfe38d957247", "comment": "Malware payload (Mirai)", "value": "a0c706c9c2f992ec27c4dd2fc98f0b19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626683, "uuid": "a44622e1-c8c7-4a81-afc0-ccf24533a41e", "comment": "Malware payload (Mirai)", "value": "00830f362ef98a57cf326919ed668750672cd57f8caf4cfdc59e80937a423a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626683, "uuid": "b44ada61-1488-4c74-b1ec-a81389dee41f", "comment": "Malware payload (Mirai)", "value": "b068769de047d920854b9bcf888a4e7da42f6257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626683, "uuid": "4d5a6a1a-ec5c-4e78-af47-321ae0f6e45a", "comment": "Malware payload (Mirai)", "value": "f29c5431d26657e0480be4206f4fb7992be7e49c8490fcb397e9b3d19ee7137fbc51c7980d3f4407a64504e6b85e3b1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626683, "uuid": "e5be1f57-d3d3-4db7-a4c2-a059b4911f87", "value": "T194332999F8029D7DF84AF77EC8130A48F530775562820F3A67ABFD932D721948C56E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626683, "uuid": "3279ee6e-4bb3-4b9a-b0eb-38360950d71a", "value": "1536:IJh5ga4s+uFGjRiSVdwOaI2ilIVEm/yfo0YJ8QzZDdMuUh9Xwjh:IJhzCuFGjRiSVdwOaI2iCVEdfwB9Kh5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626683, "uuid": "b12add20-4baa-4350-a7af-502aee56d271", "value": 52216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626683, "uuid": "3ba6db92-84ca-4f83-b908-df5a2eb88888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626683, "uuid": "7ee607c6-de33-47eb-b0dd-866a27000f5e", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31252d09-e176-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766655819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766655819, "uuid": "4df8a988-93a0-4369-b6b7-801037303652", "comment": "Malware payload", "value": "9c20eb4b701bd456156af9e450b4f0ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766655819, "uuid": "04302872-b208-4219-98ca-9691172a7a5b", "comment": "Malware payload", "value": "00989d305e97dd5b0ab7e759074810d5614427c06acb0f000705a3170fe6da1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766655819, "uuid": "d3179f68-7306-48a4-9b7d-db5a919281d1", "comment": "Malware payload", "value": "09a4062421002fd8a62f04301bb5e0b8d7de5951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766655819, "uuid": "5846867c-0ce3-42bb-9a97-0bcc0233095d", "comment": "Malware payload", "value": "b21a8a16d7f2e02146bf0a390b2496d4e2784a15a35ad0e8d5bea821ec30ccf79c8713de71639b159228baf83bd42c93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766655819, "uuid": "2d1451a0-23cc-4708-ba78-f126a76e7aa1", "value": "T17F96330BEBD789B3D591C7309B320924292D32D55353E3AB559193A50D8E3EC2DF3BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766655819, "uuid": "80475397-88de-4458-9f40-ba4d4ccf7eaa", "value": "196608:GTxf1O2fQbS+WDvn0YbFjJmpgfDH/tHKareI2bb7dWta+4OsT0LIY4:GTxI2Qb7WDvnZJjJmKfDH/tHKarDsh6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766655819, "uuid": "8d0b6af0-594b-4cf7-99b2-3c6ecc154494", "value": 9463560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766655819, "uuid": "53b5466c-6c0d-44f1-8e0b-fecbed78e934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766655819, "uuid": "b039b420-86a2-40e5-997f-47f00aa9a3a4", "value": "Google_Privacy_Policy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139c9684-e15a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766643744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643744, "uuid": "586c0940-cf77-46c0-b408-17886f62afef", "comment": "Malware payload (Mirai)", "value": "2aba6e412c4aefb728ea716bb987badf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643744, "uuid": "9c920044-c284-4841-bb5d-8fcc93b770ec", "comment": "Malware payload (Mirai)", "value": "00c80be453afb45858c3b9c5bf6dec1341c8fa494b8e9b10a29f111fdaf153cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643744, "uuid": "34fd228b-c2ad-4f6d-8498-8956c7eb6584", "comment": "Malware payload (Mirai)", "value": "f8f12af4214172787adc8a0363cfec5b92c6c1b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643744, "uuid": "7e35a357-eaa1-4321-967f-6faf31ad00f2", "comment": "Malware payload (Mirai)", "value": "c75cb6d9e994cfb1207d044ae8ec7fafcb1aa083aac1d8856d67c0bf15601ec3cb480a2cdaa244cf0667b11fa385e0d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643744, "uuid": "abba8895-de7e-4235-857b-20f141f90c9d", "value": "T12183F75AFD819F11D5D526BAFF0F528833134BACE3FA720299245B2527CA82B0F7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643744, "uuid": "390fe8d7-f9d5-4054-b01b-3928ab7387ee", "value": "1536:uhnBQeqcvR/YcNZu+3UtlyaOdL5Td3SNl+9iR8L7h5ZfYmxDTw:+QzUYcNZu+3clyaUL5T7C8L7h5J1DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766643744, "uuid": "5ac08be4-a41b-4826-b644-4731ae468ffe", "value": 81336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766643744, "uuid": "bb4f1a69-02ee-4de7-a408-1d7b1dbfe2c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643744, "uuid": "e41aacf8-4ae6-4fd4-8d7f-7d8fd2fa376b", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70671752-e162-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766647335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647335, "uuid": "c2c3983d-b756-4e55-ad26-be0adb30b64c", "comment": "Malware payload (Mirai)", "value": "7ed9dc4fa276d3140eae608991b6182a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647335, "uuid": "985a2806-cfd5-4280-8a81-6b633ac29102", "comment": "Malware payload (Mirai)", "value": "010bbe91237b6b05a100eaf2f4d77331d3c01a7d30713b68708966a12454c69c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647335, "uuid": "3a17a989-c5ea-4dcc-b9d7-d8638f485593", "comment": "Malware payload (Mirai)", "value": "e7e4293802759713827a81e9ed69f8164be3f594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647335, "uuid": "1c7d5570-f406-40c0-90a9-f15c36246999", "comment": "Malware payload (Mirai)", "value": "efe004886e12ceb5eeded4bfe1f922631c2fecca2b11080660e52836b2b0f0b22813019a4bea883dc39ebf5ffde77f85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647335, "uuid": "bfca5320-8796-4e57-8214-84698b677e1c", "value": "T1DB331885B8859A16C5E4237FFA2F028C372623A8E1EE7207DD126F55778A82F0D77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647335, "uuid": "79f1bcea-696c-43fc-b45e-dcc3b90060f7", "value": "768:fUiFKm9l8ZgZKxKTY1WmZNKj09yF2gNS+Cm7wk6036iQh3GMHTv9eNFczAheu+T:vFKm9+791tZxG7NS+AyKjhnvzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647335, "uuid": "54292f8f-2b2a-4f88-a998-bfcbed62c31e", "value": 51744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647335, "uuid": "e0653ab4-b4d0-45c5-85dc-06b557964931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647335, "uuid": "c7b8e197-2701-450f-ae66-d5a6d0167355", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3bbf33-e1bb-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766685691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685691, "uuid": "7564e49f-3325-4317-9fb4-f7ecc739d66b", "comment": "Malware payload (CoinMiner)", "value": "0e27b53656855ee10ca0263b19a63237", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685691, "uuid": "7f1d00ea-5d03-43b9-8e11-b1c812115cb3", "comment": "Malware payload (CoinMiner)", "value": "0123140c6be19898d20e5eb72063af55090061abe5d0f220c0e4b26046e9ebe5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685691, "uuid": "c651fea4-0b13-403e-a9f7-ead402b3084e", "comment": "Malware payload (CoinMiner)", "value": "d1acc17f5b9b4e5499854d7e618698de3b3e2651", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685691, "uuid": "1b3e7a02-04a6-42e2-8496-a50c671b4012", "comment": "Malware payload (CoinMiner)", "value": "c46c79ece7488bf70bc89f9e44cd5e314ebb6035a65ffd1e97c4404cc6346148ccb10c0709f17d8cf673f6c2ef7d6dab", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685691, "uuid": "56693b45-93f1-42f9-88b1-9938583821b7", "value": "T1EE3633223E21FCF0D5C2083F1580FE7642B37DAA2B2E86D75A105B341D265F9B87B566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685691, "uuid": "386d10bc-692e-4aa5-8aac-7cf1da12ae80", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685691, "uuid": "87fdd525-a6b2-4426-99d7-e0614b8fd916", "value": "98304:tq5F1xIZRCoMPEYieiwtlV1+h08FMhN2Y/Eqrn9ubtzAO/fce3Lw:tqoRC5sYiqJQ++Y8qpuBzt/f3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766685691, "uuid": "a8d47f6e-b2f3-4ebd-b561-940a641be787", "value": 4862920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766685691, "uuid": "0347bf63-a8b3-4e6f-93fa-7b48fcf1573d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685691, "uuid": "28563a87-7166-4974-81f5-ac4528e70311", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61edea7c-e197-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766670074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670074, "uuid": "20a37785-46c1-4466-8932-d9dec30177da", "comment": "Malware payload (Mirai)", "value": "f9355a5d61b3f85d21de129015dcea07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670074, "uuid": "278c624d-e301-4b2e-b101-44c66af05051", "comment": "Malware payload (Mirai)", "value": "0147519832bc67cacbd3eed6645f58d9a856fce87f8257ece379b8f8379604dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670074, "uuid": "c478b047-b6ca-4084-9a72-6593c8b99c0c", "comment": "Malware payload (Mirai)", "value": "66df100d4422ac2619b8158f75ec1bd6b193297c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670074, "uuid": "90619d9c-dba3-4281-9bfb-b71154049ae2", "comment": "Malware payload (Mirai)", "value": "9cfd72c19435106d675ee6bae3e04807608e6dd765988935f0b5439910d365f09468d7bbb944eede67005ea9cf546e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670074, "uuid": "fe90eddc-6881-43cc-b69d-efcb18c68920", "value": "T1D2835DC5AA43F8F4EC1602752137F7335B76F03A1029EA87D369A933AD82641D6173AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670074, "uuid": "3d99ec9f-1a3a-4696-8659-cc41f374983e", "value": "1536:dJduO+kWcTUGuDLNCk5ys2ScrIv7e76XzicrlsQtKONuwlSDOfRBml:IOVnTUGuDLNCLs2ncvSOXz1BNPlXZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766670074, "uuid": "6582951c-c0e6-4f6a-a876-3588f8b2e75a", "value": 83024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766670074, "uuid": "107d919e-1494-49ba-aed4-ff6354ddd6ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670074, "uuid": "1db4f0ef-88a4-4f0b-8685-0081e3cd31ed", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc3dcd3-e12c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624135, "uuid": "bf7eb0fb-fc57-49ca-a100-107b5f737b9e", "comment": "Malware payload (Mirai)", "value": "55883513efc64d667e45a2e09db8151e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624135, "uuid": "660e0c9f-c7c6-45da-8f09-e9bbfcc184c5", "comment": "Malware payload (Mirai)", "value": "0161c04844edfc0f9747581d7bfaf1de4384dcee32abea95d3e6bb36f241800b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624135, "uuid": "d96d0ae4-d9b0-4364-ba65-416770f543f0", "comment": "Malware payload (Mirai)", "value": "b0da6faa5e84257ba463349612b777ce618a2054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624135, "uuid": "e49cf885-6598-483d-af8e-3b69acba560e", "comment": "Malware payload (Mirai)", "value": "56e3bbfa3eb5886d238346740861812633c622d5faf1fcda378b3a9b999806cb2a07a1f6bd28690ec6c85dcf3658b502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624135, "uuid": "c40f4619-b864-4a8f-9d0b-3ffe4d4d2bc5", "value": "T143635CC99643E4F5EC2509715077F776AB32F5361029EAD3E7A5E632F822201F6063AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624135, "uuid": "c5daa655-f206-4115-8892-5cbd093fe9ee", "value": "1536:QFC2q7XY2YUMNx7fVRzLilJ65OOed0A7QOLmxyNbHr:QFM7I/pNxDVcmORGAkw6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624135, "uuid": "88227362-ad46-413b-966d-3aabeb113495", "value": 71536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624135, "uuid": "fada39a1-8c3c-45df-aa22-e5ae018cb819", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624135, "uuid": "085e2cee-c887-4a56-8d01-91a54df164e3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bbe631-e187-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766663313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663313, "uuid": "9a39158c-7847-4cbd-8f8c-53f1f6e85a2b", "comment": "Malware payload (AdaptixC2)", "value": "bc5543b39d89cda6832706948945f567", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663313, "uuid": "94a6a654-8a57-49af-adaa-a97d5719a74b", "comment": "Malware payload (AdaptixC2)", "value": "01c29e84ad1a5fc1f2d16a93fee1c6386aecef1a99153eccaddbca54549befd3", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663313, "uuid": "fdd3b6b0-4a9e-460d-8edd-00965d3c8bdb", "comment": "Malware payload (AdaptixC2)", "value": "98c88ff395c1f2ea68b5b2c4ceeda4e9e9a2e595", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663313, "uuid": "671de383-7faa-4589-9ad0-9aa66ac25970", "comment": "Malware payload (AdaptixC2)", "value": "d561bcd0442a4bc18d7e54c8d31a2e1d59363890a6407b49001dea5e13b96945d62647aa5acaec2b643e06f153dae3de", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663313, "uuid": "10c5497b-658c-423c-a596-e8663b66320a", "value": "T150836736E6B3C4ADC06FD534AF43A4B279F17C1C4634661947C1A6223B6BD386BBE640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663313, "uuid": "b49d88c9-6e6a-4d75-8ac3-785b24007967", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663313, "uuid": "7cd4e542-da0d-4c48-b06e-0ce5e0805ff9", "value": "1536:C7mVGS0CFTvMLWls/QwJbguY++6CchVgsXwbFoqk3yGoFA9rYa:CqVI7Xhu66qB3DoiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766663313, "uuid": "06fd3b1d-b1ba-4c78-a5bd-b964c44b8a6b", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766663313, "uuid": "3dfe69c2-454d-4fbe-8e30-c922a7b3f204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663313, "uuid": "3542ebde-56f9-4720-a208-c2fd76b952b2", "value": "bc5543b39d89cda6832706948945f567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a853f6-e17d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766658751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658751, "uuid": "d545b7cc-5d51-48ab-8d5d-aced6c48b143", "comment": "Malware payload (AsyncRAT)", "value": "df1bad9247402617af66f1733b7351a9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658751, "uuid": "675e194e-cd4f-4b02-934c-e5f272001351", "comment": "Malware payload (AsyncRAT)", "value": "01e97451a9983dda69144cab8fbf5a053eb012a94c89a14e3437ad66862bc3f5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658751, "uuid": "c20b9aba-eee9-453f-b6e9-73d91d16ea14", "comment": "Malware payload (AsyncRAT)", "value": "9dedc0a5fca58ba3e54700a390299d3998e2fffb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658751, "uuid": "ae9c0cf8-3383-44db-b2ef-7878de600a95", "comment": "Malware payload (AsyncRAT)", "value": "7a80d7e5e437973d2ae1f8b6cc2a0a48bb4f00101efbe38b4fb0980034d1b163b6d86c6847f9a9d8c57000f80ea537de", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658751, "uuid": "3c272678-7c11-4f2b-bd96-a46c48c60f54", "value": "T1D2737C183BF68525E1FFAFB05EE17162CB36F6632903E65F20C5029A1627AC9CD412F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658751, "uuid": "cbd09299-adc6-4d0a-874e-09643adc4d88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658751, "uuid": "346aecbb-ddc2-4da2-80b2-ccaf21583ec0", "value": "1536:4e+LD8U327dtOpLu4Np2Rd1Fx+bDw3ns6vBvb6IEOOBLD3vF:4nCKuLD1Fx+bDw3nJvLOxDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766658751, "uuid": "b890cc1d-b3e6-49f0-ba06-2c6f8a63b365", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766658751, "uuid": "27ec5553-8ca4-453a-8f96-a133da17f021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658751, "uuid": "4003a71f-c9e7-4821-922f-a95b3ef88cf5", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdabd79-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766690333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690333, "uuid": "7f17a35a-4cd8-4ef9-b193-a93feca938f2", "comment": "Malware payload", "value": "fe7d1673c2ee4922ea9fa4093e3a5eca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690333, "uuid": "7cb8aa63-0456-44ee-b2b4-fa5bdf2a4dad", "comment": "Malware payload", "value": "02568ac35387d4734b48cf99f171e043cd0ac5718fca8756c526465686eb4321", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690333, "uuid": "6830d58a-5960-4434-87d0-9717021b3279", "comment": "Malware payload", "value": "6749a5e7771a46057b49ec168eeb5a145019ea6d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690333, "uuid": "a81483c0-f61e-43dc-9edd-06d44f0b201a", "comment": "Malware payload", "value": "6d6b1608f9b4607aa0c7394b75413c3dc993d13204c2c766f29a33b1107758d7e18d9fed423b2bdf86863ab5d14f4146", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690333, "uuid": "991ab472-e2b3-465f-a3dd-c0675833a715", "value": "T1BA21C3CE11D112714848CE58697B840C95D9B9C1AC90EF7C98CC1E7F9D95E7C713AF29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690333, "uuid": "0993b29e-3187-4997-8ce8-983b83284bf6", "value": "12:oF1ioEhbbslxf9NIl5DnCa0LKcWNgO7OJi6cO7AhSvbANtxKbrf2G9P60ftdv:yaClfNI7mK4jisqAcNto3O0Pzf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690333, "uuid": "60980aac-541f-4172-8d85-5bb8583f6781", "value": 1121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690333, "uuid": "b52d9814-e11f-44c5-a10c-6742a5cfba90", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690333, "uuid": "a50498d4-c456-4a00-90ea-590fb72bc422", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209c6635-e197-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766669965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669965, "uuid": "38c3796f-0074-4927-b381-724b83ea9395", "comment": "Malware payload", "value": "b309661ea61ac99631712683c212774b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669965, "uuid": "0b90b833-8d77-42c7-80dd-71ac9f894027", "comment": "Malware payload", "value": "02d851d0b9a95190f19731d52f038f2f49ca6e1f9c32b1465b0e6718654c9c77", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669965, "uuid": "5457486b-c006-4f75-b562-325983227026", "comment": "Malware payload", "value": "d6926450f1d1ab0b4d0277bf73fd47a17825458d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669965, "uuid": "ff46cc61-cb67-40ee-a336-6c392aa713b3", "comment": "Malware payload", "value": "f5ca0d80e35e80667b70cf9b1da277ad18f766480766279fff171939e7bccc3940d544e1ad48f3d9ff0dee0835315019", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669965, "uuid": "c113aea5-c187-41fc-9a02-9f35893f7165", "value": "T1C5187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669965, "uuid": "96407bf4-dd33-4319-90b7-a1d867950ff0", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669965, "uuid": "b65016ee-13e6-4655-95a7-b624ba340931", "value": "786432:BAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:BAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766669965, "uuid": "6bc2213d-6f9a-4ada-8882-14f77f383202", "value": 90442240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766669965, "uuid": "e603adde-0f2d-4114-babe-d97cf9f35dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669965, "uuid": "073d19a0-41a2-4db5-92ca-9c95aeb69dfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20774575-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690151, "uuid": "a648c113-117f-4d5d-a5d0-d6356837bfdc", "comment": "Malware payload (Mirai)", "value": "2b8d695f0fb5a599ff1b4054a82a780c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690151, "uuid": "49e4242b-bd67-4df1-b9a2-a2593953f358", "comment": "Malware payload (Mirai)", "value": "03ecda01330d867752a09c2e6118fed74a061d4f5222d492ab43640e0d36e6c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690151, "uuid": "60f292f8-77c7-49dd-a59c-c5891e56ed79", "comment": "Malware payload (Mirai)", "value": "f0d5b04d4b59f144a414d59244405d0d0c106ba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690151, "uuid": "d047a70a-a8fd-4846-9fa4-c992c8a92569", "comment": "Malware payload (Mirai)", "value": "09d10c7cae822a0681426327e3ab2b33f1e44403f0f7c03905e760f5c830dcfff30c9003751d35c78df601585801a7c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690151, "uuid": "6fe5896f-1dbe-4e78-8ca0-4d23a790a0d5", "value": "T13DC30780F88B81F5D40B8C305166F73FDE32D5A58235DAAEEF989F36EB67642810525C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690151, "uuid": "fcc5a7a2-4fba-4919-b54e-8b6cde097827", "value": "3072:uNfHdrH7hrsrrngoqmj4Ij3RmvaLorLvfb9uS2nRO07Xsv:u1Htxsrrngoqmj4Ij3RmvF5ssv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690151, "uuid": "0c2082a9-b78d-433d-a764-6c061189e71a", "value": 120112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690151, "uuid": "837c97f1-b81c-4ecd-9b5b-daee53d88c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690151, "uuid": "3b75f774-0047-4c9f-b35c-7efbe3e07b6d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fb5297-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700897, "uuid": "9e5853fb-089b-491e-8a9d-a228787d258f", "comment": "Malware payload (Mirai)", "value": "b663f951d2075732c4b1c0ed87b6dd2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700897, "uuid": "1a554262-74c0-45cd-be8a-9aa2b367ba17", "comment": "Malware payload (Mirai)", "value": "0480bd9f006fa49ec297d7950e553159a1cecff408a59576c770ac886f9d17dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700897, "uuid": "3ce3cd5c-4625-4eb6-a64f-1c5b99f6aef1", "comment": "Malware payload (Mirai)", "value": "045fc23c053a6035cd5dfc6690e4a379ac413b75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700897, "uuid": "861f8ae0-4b14-4742-80b0-0e2a917329e2", "comment": "Malware payload (Mirai)", "value": "8feabd0ae8dec1acd7f5f5df922d91c1b1e2d89625d897e9356296ca74837623b1ddf03c626865304b34e4c8bb4e5d01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700897, "uuid": "d57e15f7-8bf4-47f2-bcc2-608dbf02c657", "value": "T1E1C30940F94B80F5D5078C7090A6F33FDE32D565827A85AEFF999F36DBAB642810528C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700897, "uuid": "d8aecea0-7032-4d6e-b081-1a15aed98a1a", "value": "3072:fTI1fLhwpjLKFWnGYPIg19afv3cwkWeAeStzHkBsZsRC:fTI1f+LKonGYPIg19afv3cw9ePzRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700897, "uuid": "68b94be1-4a82-4918-9dc2-77985719e27a", "value": 124180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700897, "uuid": "64f26524-5932-4bc2-8919-1aaf96c02a5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700897, "uuid": "a86d5bd1-2147-4f7c-97ac-b121eb26f92e", "value": "i6_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f391fe01-e127-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766622215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766622215, "uuid": "082fb910-6ce2-4100-b533-b7d0cffeae02", "comment": "Malware payload (AsyncRAT)", "value": "668204872e560b60e5a215520f3899ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766622215, "uuid": "b508cccb-2ed4-4d1e-a487-c1d4422c859e", "comment": "Malware payload (AsyncRAT)", "value": "0492c5b3cd0252588453159777ae680f16a39c0ccb2995c85d2e63c020db5cc4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766622215, "uuid": "2c749ce7-b3f1-42ed-b527-d53a08034aba", "comment": "Malware payload (AsyncRAT)", "value": "0868b81121eb79505a7d46786e1c49d98052e4db", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766622215, "uuid": "e0fb5b3a-4f15-4827-a40f-825a9b031e88", "comment": "Malware payload (AsyncRAT)", "value": "76a9f6b1aa99957657dbd8818e202b27db9b802f937d244a71196142ed8b8e81bdd97fb0ae6663b658af598b8a6a64e0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766622215, "uuid": "0cd00eb1-49eb-4e75-a862-72e10495bb4d", "value": "T12FC21B0473F58262D1EC4BBE48329200D375E58B5D13DB9F6EC895AD2A337CD8A25BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766622215, "uuid": "ec44728c-a7c8-48f6-94d8-9aebabd3ea26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766622215, "uuid": "950ba7d2-73c7-4c13-972f-0d84fc8ecb2b", "value": "384:4z63zAdXwxFC2pzgeDUQkxkMymrJhx8HqqbuUsJQxnCJf+BWfXW+/Zu+:I63zAJ0FCqEBQkOMyCJhxSFbHBFBMu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766622215, "uuid": "4ba3172c-b78c-4a31-b6f1-7e4748fb937b", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766622215, "uuid": "31e1f785-9571-45ae-bdb5-c29d65180cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766622215, "uuid": "faf4d0dd-8abf-4fa1-95b5-19cc288574ff", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ac876c-e133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766627267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627267, "uuid": "b0872779-a3e4-4071-a518-e8712f40f3e8", "comment": "Malware payload (Mirai)", "value": "acdbd52904c2185348d88326be0ab928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627267, "uuid": "40dc99d7-fb22-4d57-8681-189186d48fba", "comment": "Malware payload (Mirai)", "value": "04c3531d541962af0877e71affbce5ab8fd9909d4fba6875c5007736469a5c1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627267, "uuid": "fa25d91d-cb79-4d93-a48d-e9621bf16e3c", "comment": "Malware payload (Mirai)", "value": "884038623992fe7a0b538f06f318206e74d8ec0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627267, "uuid": "6ece5967-218e-4b9a-8584-8d184794cc43", "comment": "Malware payload (Mirai)", "value": "c279f74225d77125d8d9ad3044cf6cd2918bab290885377c49e0c602146d18c1386917069a2b585b8a45a830902f5340", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627267, "uuid": "1cc756bf-4f8d-407f-ad4d-3b7759ad64a6", "value": "T1AB930856B8918B21C6D462BEFE1E118D331317BCE2EFB2139D146B25778B42B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627267, "uuid": "b041a038-6e8b-441e-be4b-a56e55061254", "value": "1536:38n2SMKgjlBGRtp7ukqgw59wqimX9UVqteTVA0zvT2xWy3xMDiU9dou5oAT7HpYk:W2jD9ZqqtepA0zrB9dou5oATDp0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766627267, "uuid": "7ca274bc-4231-425e-8faf-88be7db65cd4", "value": 89000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766627267, "uuid": "36fa43d9-5025-4c3a-bec8-e8d87fa6959b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627267, "uuid": "f6d6ea33-46e2-4286-b187-90158f20709e", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59710edd-e132-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626681, "uuid": "7b32ab36-f835-46a2-9c98-b4cdaaaa8c1d", "comment": "Malware payload (Mirai)", "value": "e3c7d0a5f7c26c648268714bcfc1c3d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626681, "uuid": "81882fb1-ded1-402b-8e31-f95bda4f4124", "comment": "Malware payload (Mirai)", "value": "054f29f0617f5ce767592e6fe437e54b221e83f7c8d5d962a8cc1076b6663695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626681, "uuid": "c17efd65-fde5-4227-b8f0-3dc8c642cc37", "comment": "Malware payload (Mirai)", "value": "42fb2ea1a299ef9b58335309fcb86030d415d111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626681, "uuid": "14a8bc3f-9ec9-4ef8-abae-64fbc0b68d11", "comment": "Malware payload (Mirai)", "value": "a1bd6037a351f305b9834ccb5ff9b344b4e109a490fc9bc26eb549a062d3f657e7be12c4176e8bd7a428a740c77720c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626681, "uuid": "6f4b85be-80c0-4b0f-907c-b478a30c84fb", "value": "T184A3074AFC819B21D5D526BEFA1E118D332357BCE3EF7212D9105B25678A82B0F7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626681, "uuid": "2e413e53-02fb-419d-8af9-328efc5983c5", "value": "3072:TICWl2WDzxIxrbFiaf4L0Z7naq6Zj+PpGb7V79jlT:8CWlfdIFR4L0ZLaq6Zj+hGb7Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626681, "uuid": "dc031f62-26ea-4b29-b258-b5c39e2f098b", "value": 102428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626681, "uuid": "278a0e5e-812d-4da1-9c45-9ae4f5075980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626681, "uuid": "dd3e031c-e173-4125-ab88-bd84f79c0327", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428c2030-e12b-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766623636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623636, "uuid": "6821cb59-f9d8-4f5c-96cd-9305df2079f4", "comment": "Malware payload (Gafgyt)", "value": "b1c2894691c65d0926d9673ee55591f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623636, "uuid": "7b8a143b-7e2b-4042-9d9d-2bfa7f1919e3", "comment": "Malware payload (Gafgyt)", "value": "062f19f3c8f948c4d88ed7a163207f02014708635f57ac17c77e4aabfb10d264", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623636, "uuid": "cd04e6b5-69c8-4781-8791-e40306bc64a1", "comment": "Malware payload (Gafgyt)", "value": "5e48e015f93c0de963b475265d18aa033d89d37d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623636, "uuid": "974ab4d2-344e-4c88-9896-2c6e2703f584", "comment": "Malware payload (Gafgyt)", "value": "d569c529a92864fe17f54c3ca9c6e17734b6a1021723bd1e9267dfaa53b842af0d82530b333ea356a00d353058dc1712", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623636, "uuid": "d663fe82-5591-4083-aa2b-7525f334d3f4", "value": "T11D0121C710A11A72AC60AE63F2758518F5C2E1F780D99F05B9FE79D6848DE14B845AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623636, "uuid": "f90486ab-5a75-4cce-8c8d-b5b15fe664c0", "value": "12:Gn0FnLgffd8Pi0FnLyONA5L50FnLxWv0FnLtNNIk2l0FnLG4eGmX0FnLjWhB:10A2aiqlZTNIgqTGBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766623636, "uuid": "ef37e8a8-cda8-4661-a352-15dd90758fc6", "value": 815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766623636, "uuid": "2b1d8e43-bc08-4e7b-806c-2983c3b0de9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623636, "uuid": "89f81883-fa4c-42c0-9ce1-fac6c46ae052", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d939f2-e173-11f0-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1766654517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766654517, "uuid": "3375b939-b13c-4237-9479-2590a5135379", "comment": "Malware payload (Meterpreter)", "value": "306190ce0bec226ff575d2a378379ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766654517, "uuid": "902b1aac-ecc8-48d2-bf71-d9807126f882", "comment": "Malware payload (Meterpreter)", "value": "0686e753fd913d0c9201c8d3559c5e49f6c5791e6fea3c4fc87f67c7df4d830c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766654517, "uuid": "db9e1a17-0a5b-4005-af94-d4b8cdbbfd0c", "comment": "Malware payload (Meterpreter)", "value": "7e02970e7e5f43c52e3873e03c57a6e5403ca207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766654517, "uuid": "fa72bfe0-6bdc-4477-b37e-fcdac5a5a2e4", "comment": "Malware payload (Meterpreter)", "value": "fe5aea37cff6d0be40e988639bc7877df156b88a8a9f8174b7e467e706b8917a8940ef1d6673d7ae18e97403755e27a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766654517, "uuid": "3d5239f6-c4a9-49a2-a90e-d6fa606ecd39", "value": "T1ABF15487732619B6FA7807FF8243CBCB52FDBB315263070E0514101B6151529B970F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766654517, "uuid": "4863e800-ab3c-48ce-b572-a623065c8304", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766654517, "uuid": "ccfec7ff-d37f-4fcc-8a21-dc393e2a9385", "value": "24:eFGSG+P1pFiknehtht6dp5ta7lKZqteNDMSeXitp:iG41HnehthEdlalPSD9eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766654517, "uuid": "2603aed6-c23b-4ec6-9414-8fe0c997b3d9", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766654517, "uuid": "00d45bb0-d68f-45d3-8aca-a7fb9997ca45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766654517, "uuid": "2854b962-a471-4ea4-9d5b-a745a0e74c39", "value": "p4nd4w4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98f3482-e1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766707131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707131, "uuid": "0638f8e0-bcc1-4edc-828c-199de5d4ecdc", "comment": "Malware payload (Mirai)", "value": "bc4e4247284022f48add116d593fb07f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707131, "uuid": "812eb512-161c-4ded-8aae-b3ae5739648e", "comment": "Malware payload (Mirai)", "value": "076a47484d65e05e01c9fccd050d20a2e2381e6ab5dd134c97f61f3398a871f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707131, "uuid": "8e5c9250-6e41-4327-96d3-2591aee10779", "comment": "Malware payload (Mirai)", "value": "3de7de0effebc33260364290d6a22cdb474f8a4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707131, "uuid": "f1942664-5921-455d-9179-a500f7f834a9", "comment": "Malware payload (Mirai)", "value": "e5001b46c2079a4a761570636d08789f2c81e386ad4a255b2f9e958d64b5571a56572f4b112226c2875a53749ccdb55d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707131, "uuid": "a88a3913-062b-4b7c-9248-bce354b53f90", "value": "T1AB935B31B97A2E1BC1C4A57E21E30734F1B7274A25ACCA1F7DB20D9DBF246502117AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707131, "uuid": "88ef6393-cc1b-41d5-a84a-bfe0a42108f8", "value": "1536:IrClWMSlilRHqwM9Hrx9fQGtZeUEyVWVvHRbrJoQ/d8KQ/xdLcTPT8zm7uhG:4WWpkqHHQGffDqbip/xpC8zmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766707131, "uuid": "c3bd997b-9599-46da-a693-332182573331", "value": 91340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766707131, "uuid": "92c3a6cd-6df4-4e24-8470-50169649a077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707131, "uuid": "ccd0d819-64c1-4f17-9663-456a7431c90c", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd15926-e151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766640133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766640133, "uuid": "a73bab91-a540-4f55-9c76-8cd0c0b6b986", "comment": "Malware payload (Mirai)", "value": "5779a4b4ef8da93dc6f46804396b77a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766640133, "uuid": "858ad0d8-3736-436c-8752-ccd88060b60d", "comment": "Malware payload (Mirai)", "value": "07eb0dae699041f6d865858f55623255b8a04efba7e37f90155a9f83ae6f1eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766640133, "uuid": "90b331db-b1fc-49d5-87e0-5aa2e4cbe290", "comment": "Malware payload (Mirai)", "value": "2929e286563267e3cd76a117380dee7c92243bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766640133, "uuid": "2a72e340-38d5-4b78-9ce6-6d0ed307f1cb", "comment": "Malware payload (Mirai)", "value": "9b05f93ccf7c22847bc942736512b27f61f8fc93c64754082cb3f3f63af2c4c8f65fc6a41ec308f63641c1ec13210b32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766640133, "uuid": "27bcbf08-dab6-4291-b128-68d8705a530b", "value": "T132430885FC51CB21C6D0227BFF1F829D372653ACD1EF7203AA195B65768A86B0E3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766640133, "uuid": "6a59b0da-37f7-40c9-8683-65cdd795e2d2", "value": "768:MFNKtul7537+f9G3kMfdzAZa0BF5W9KsnTNUr7RWfBt4iEwY+6RP3a9DtTwW:6NK+6ydzAZTL5rFAWd3MtTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766640133, "uuid": "38a5e64f-e841-473f-aef9-8b824410795b", "value": 56648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766640133, "uuid": "b8874d70-511c-4200-a3a2-73daaedf607c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766640133, "uuid": "772b98df-3531-4707-99a2-9b8e392148a1", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0959ec-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690871, "uuid": "2e80a1a2-6e1c-46a5-94c6-a1c95cb257d9", "comment": "Malware payload (Mirai)", "value": "97b0b7123bd8c03c16f2062724163e4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690871, "uuid": "f90a2675-977d-480f-9719-f48794f5699d", "comment": "Malware payload (Mirai)", "value": "083f6fb36ef78026d188b7da760165fe36060edf9331ca9da14f35ba793ab94c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690871, "uuid": "6f1d6201-349f-4c6b-8913-a88229f97570", "comment": "Malware payload (Mirai)", "value": "99a9c9cbe5bd4743ad0f91e9509be19917a355cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690871, "uuid": "f7ab4a6d-929a-47c6-9f24-f25a3502e126", "comment": "Malware payload (Mirai)", "value": "2882254f48b5604542bd392033e183f9906b33ed35557772e51612e8dd584a4c6cbfdbf4a56cca8de7c2f00d214a519f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690871, "uuid": "803ad65e-8459-4c81-8a1e-dd4759756af3", "value": "T1BE21E27BFBFB8B16C854917A0E6363153620DD4C0115D269BF12661EDC526516F452F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690871, "uuid": "57505ea8-17b8-404b-9760-02cb4a1fa05b", "value": "24:3z/Dq3N0yTK+59kRPO8MtQLvhCDjSkvFiJ9lO39VNTawqVU:3WVT34PO8M2cvO94NVNu/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690871, "uuid": "7db24446-3612-409d-ac50-9a8efe0405dc", "value": 1288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690871, "uuid": "ba7e22b9-2058-472c-bf68-161fc2611f83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690871, "uuid": "ec7d50b2-b2b2-4237-989d-a68ebf730cc1", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199a8e87-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1766672959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672959, "uuid": "14cfc809-0116-46e6-ac6a-1e25eb4d8c0c", "comment": "Malware payload (SnakeKeylogger)", "value": "5694e46103c9d126ce83e3e9a4edf469", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672959, "uuid": "d7c7760e-f40f-464d-9f60-10b3197755cb", "comment": "Malware payload (SnakeKeylogger)", "value": "08c3a593230604321bdcb4f44752002cfd57470b27195d7773abe45ebc6cadcb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672959, "uuid": "deea08cc-7153-4df3-bfa4-5f5fed7b373b", "comment": "Malware payload (SnakeKeylogger)", "value": "c83cf8322bb6293cf3835b1149f5fc2bd7d41bda", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672959, "uuid": "cf14771c-85a0-421b-9552-c74b7df43e13", "comment": "Malware payload (SnakeKeylogger)", "value": "4459b5f186b3f1285fe37651293b2ddfde596b55f8eb679ea4a115f8dba8dd9e4d58e279a9f453dc19b6a139e6bd55c7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672959, "uuid": "9c21d236-48e7-4e64-9b2e-3091c5c2a66a", "value": "T17726625965E00AC7E02779FE6D281EA54C1A3D1B97C29F97703AF2EB741EC488630D27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672959, "uuid": "650825d8-ce28-46e5-8ba2-7ffecbd78c50", "value": "49152:RvSIU838BHP2R7FCy3Mbhvi8yW7VgLDoDD0WribWvKVZuoU4nxDO/bH0gUSKVJb+:pD3Yv2R7FCy3MbhvEWZe2kRlomYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672959, "uuid": "479a6d94-1ff8-4d0c-af0f-c271a1b4020f", "value": 4836214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672959, "uuid": "ee892ec2-781e-41a9-9e8f-72bc0a96eb38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672959, "uuid": "beb9a1bc-7350-4770-84c6-250a7802c4ff", "value": "invoice and bank slip.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3d1243-e19c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672209, "uuid": "c135f905-d295-40cc-a344-a4e4398e7896", "comment": "Malware payload", "value": "18c259295a92eccd2745658c87323b81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672209, "uuid": "8e2a3f3b-1853-403f-89e9-d29989690e6c", "comment": "Malware payload", "value": "0925e28bc6c8046e700665c6583692bf1fe41b29acf88a00b1932c98a5d5338c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672209, "uuid": "5b51b83d-39cc-493a-a0be-56a20a6ddd2a", "comment": "Malware payload", "value": "8891d38068396cae995c94533b548ab4a70ab56d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672209, "uuid": "76976eda-96cc-48ef-909b-4669a526e94b", "comment": "Malware payload", "value": "32d815a5775d38f19d1035bd04e37dedc47c8511177c1916ff2ed426c884622053cfc0492af026fdb47ab96460fcc681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672209, "uuid": "cd52974b-0a12-4b4a-8a07-5d8e3c38dbed", "value": "T1607152B2E181E6E2D49A62B902A68FFD7E7942318F4086D3CB255DB264017F4AD3356C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672209, "uuid": "796fc2af-2aac-4625-8c86-494ea632daec", "value": "48:jtWWae+lEpWzRdIw8UNUaNg4OGfeg8TK/j5PNBltENsfI+wGEFTCNX1mQN:Zmq4zRdIwrXNWO18TmjRNBltq+vEpcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672209, "uuid": "f07edf86-a37e-4647-a67a-d4afd4de5290", "value": 3583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672209, "uuid": "b941b5e3-203d-4e63-b07b-58653691d45d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672209, "uuid": "547661d8-7326-45fc-8e87-0ed15574ef16", "value": "Photo.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed27adf3-e189-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766664295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664295, "uuid": "651b6b23-7e33-4a81-a474-b70281f8432b", "comment": "Malware payload (AdaptixC2)", "value": "0dbaee8bcc15e1b4b424d07e8a4b8e4d", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664295, "uuid": "24099f4a-78f0-439c-a4b8-4050e95e319a", "comment": "Malware payload (AdaptixC2)", "value": "09492c8a5138c3c1f00d19fa2e1b798f271e2730d74e9de69e926d5c0a92f64e", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664295, "uuid": "daf19cb4-f0ab-4e31-a919-e95d2ae100bb", "comment": "Malware payload (AdaptixC2)", "value": "b6f5fbafe39b635faa7421c2f5567b67d9c122b4", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664295, "uuid": "1bd2640a-a610-400e-8b21-5951dc563df1", "comment": "Malware payload (AdaptixC2)", "value": "1e8e29a436b82a66d42a12e7eb58f698e2b61d5f100f544a7ea4774249307c37e22e3c1d28e965f5fbf7e52362aa18f6", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664295, "uuid": "1b91a15e-474f-4068-a090-b631c864d14e", "value": "T177045236E6B3C46DC05FD634AF83A4B3B9F1BC5C4634651947C1A6223B5BD386BAE180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664295, "uuid": "793a4504-31e3-42fe-a44f-612476318fa7", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664295, "uuid": "d5cf77f2-4dcc-4bbe-990e-a05f2a59cc86", "value": "1536:5mjklNrqI1q3y2D79tGRh++TVSi6nYVa58po0e2/T20yZF+E+aD:sj2Kv+b81KSdZY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664295, "uuid": "86e88bec-f118-454b-ac18-9f3a9c9b08df", "value": 176304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664295, "uuid": "3fc42bab-7723-408f-82ad-15d72ac76bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664295, "uuid": "4ceca519-5197-44ff-b7d4-1aea22204f51", "value": "0dbaee8bcc15e1b4b424d07e8a4b8e4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208fd5af-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700888, "uuid": "f0326385-bb9b-4a16-9d39-970838a1de16", "comment": "Malware payload (Mirai)", "value": "bddf940423d9d89dc9aa6cab269bfd74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700888, "uuid": "3990df73-b1fe-49d9-98df-1759472c99ca", "comment": "Malware payload (Mirai)", "value": "09579665530d396fbe2977ea889ea670c9ce7301c517dd2ba716b74c775594e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700888, "uuid": "dd2b0963-b6aa-4a80-8916-d76df55c321e", "comment": "Malware payload (Mirai)", "value": "2e746d23e6f52e1a8f1373eeb3e2c8d4af5477ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700888, "uuid": "ea0784aa-56d2-43e2-8c71-e4ddea794a6e", "comment": "Malware payload (Mirai)", "value": "e8821b3948242637027bee3c3b8fb955338bedc66c15c27c6a148be13e94eda1d098ac51ab1118768b9beb45e6ab03f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700888, "uuid": "e613f1f3-7e1f-439d-b484-ff50d7435576", "value": "T1A6D33951BC829A27C5E523BBFA6D018E336667E4D2DE32178D215F217BC680F0D77A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700888, "uuid": "ee9da2a0-c554-44b6-bfbc-c5949adc33cb", "value": "1536:PS8nLiVgYTveJ1WRHLBnUVLPWLKjyzhEA3sJ+xtLP7C0G9bDJpz4pnD+UwvL7:PS8nq7JSViLJ3sJen/G9PkAL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700888, "uuid": "f619993b-c354-488a-a2e2-41645bfb4485", "value": 133980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700888, "uuid": "b2451abf-991b-41fa-b00d-33a5fcc3b210", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700888, "uuid": "5392ad35-f5f5-4138-8267-324d04c8472b", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160f4eff-e1bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766685838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685838, "uuid": "d9540da5-8f29-40f7-bbfe-7c9f398b52df", "comment": "Malware payload (Mirai)", "value": "5bf14a6671a4127db715525795c3f331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685838, "uuid": "44a0a5f4-d014-41a9-9d2e-d07a4cadb10e", "comment": "Malware payload (Mirai)", "value": "0969a338fb4cc716e8c91964b71801b4363afd6c58cae5e22f0ef1a0b28cb415", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685838, "uuid": "fe1aa22a-2e84-4568-9733-649e0cf1a0f6", "comment": "Malware payload (Mirai)", "value": "1e489f1d54fe3cacc9ac96df764710bfaf636e5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685838, "uuid": "27cfd3c8-0e16-4bc7-b34e-6fea94c4bc02", "comment": "Malware payload (Mirai)", "value": "21463f1b71bcefe377bbff21e45912262f802b40aed501d3fd7f417f696d8ed5b158d1d6fd75e7267216c38514a669e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685838, "uuid": "3ceea766-18c1-4627-ab1f-8bf419f25fa4", "value": "T171B3C609AF650FF7EC6FDC374AE9170525CD651A21A87B397A34E818F64B20B06E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685838, "uuid": "b2a44efe-a17d-42d6-a72f-e78ea29e698d", "value": "1536:SM8zfk4RS2Lwa7QFnXYCR3vqqQL+7UJehBEWJj8xP4O7Z5D+oaC8hQtll6:L8zfk4UcQFnro+8acGhull", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766685838, "uuid": "ad0da38b-5d6c-4aea-9343-e9e19118cd99", "value": 113524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766685838, "uuid": "a33d7d58-2160-4758-919f-396d4155f569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685838, "uuid": "808df239-3010-4837-8e6b-e5a8b79996e8", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079c48e3-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626114, "uuid": "46c939f7-5db4-4149-9814-57e437d2b4fa", "comment": "Malware payload (Mirai)", "value": "445399044b61e715ccc618bae803c27c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626114, "uuid": "f556887a-86ef-4eb6-94c9-7fc9e2402a2d", "comment": "Malware payload (Mirai)", "value": "09cf198529a81088ec17999541b24a634b784da7f97e4e8bc285c9597d0f4fec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626114, "uuid": "805944a4-eebf-45e1-9b78-7a3e07598df3", "comment": "Malware payload (Mirai)", "value": "137e65c08c59b16ff0ab786a4f9e2a944f78dcc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626114, "uuid": "4727fa63-52ff-4420-8262-b599832f421f", "comment": "Malware payload (Mirai)", "value": "577f3a5e29f2f2ce78f2817030fd153d73a3aa11fccc3a6145380cf02a325aadd228e2e8b83bb69279f8b8e369e3a35d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626114, "uuid": "4132c4b9-73d0-45e7-b720-2172c8881b8e", "value": "T1BC334A02725C0F27C0A71574253F5BE19BFBEAD122E4F285294F87668A74E331486F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626114, "uuid": "d3e3ef18-e9c6-47d1-baea-102ce4b10546", "value": "768:LN/yruNDLJR1PpBDdGtLGRI2KJa6l1jd0HX7qxYcOu+LMgIjucwT:lvfd21NYa1jdwuWudgIy9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626114, "uuid": "83281d00-8dfc-49f2-8645-79cc8405e4f5", "value": 51636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626114, "uuid": "79aae0b0-7dc7-476a-9882-6fe471d9b181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626114, "uuid": "cc46d55d-b004-45a6-b3ea-1bf88a76406d", "value": "0.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8992884d-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690327, "uuid": "331bcc1f-9899-4d4f-a0d1-0afa8872960a", "comment": "Malware payload (Mirai)", "value": "67d483113b4c071e4cd382b7108b7ba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690327, "uuid": "b72df99d-dcf6-4866-8f0a-5d6b82fbca48", "comment": "Malware payload (Mirai)", "value": "09f537d23fee22dd9a56a4a36c20700c264fb17ca9e3698b91c0e9d67e1e4b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690327, "uuid": "1019dffb-489e-4082-bd1c-932c58564d16", "comment": "Malware payload (Mirai)", "value": "373aab329d8868a12bddbfbcf96571e7e12f5d2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690327, "uuid": "875df694-7f44-4557-ab72-fd7a26dbee65", "comment": "Malware payload (Mirai)", "value": "e33fd23645509adfe30993c8411ecbea8a6c440fe6b0cbce471e83f959e69a2d2a668ad06c5d2a3f47a4529923339d53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690327, "uuid": "c45ed9b9-e871-426e-837f-1a471232fa99", "value": "T1FA2165A193E8F832D72210F65286AF8B2721CD95295BFF0B8D405402ED3D1C0D132774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690327, "uuid": "1c993853-d3b5-49e6-9808-eb9444849f51", "value": "24:FlL8M85FHxgxk2ZO4l2ZWVGCCTRwvMQzGu92/47GtruQpioNfL:fA15wOewWVCTRwkQzh2/4yRHEoND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690327, "uuid": "c33b1b8b-c2b4-4baa-96e3-59d7ddf25819", "value": 1184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690327, "uuid": "461a45ce-aac1-4062-b58a-4e5155ba2190", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690327, "uuid": "0d64c2e6-5f71-4690-a1b6-cb71676ac012", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d33fad-e1c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766687526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687526, "uuid": "e5681431-8ce2-4f50-88e1-1e17dd289bf9", "comment": "Malware payload (Mirai)", "value": "6d1f64eaa8b0dfb23ce1a7f33f2d0539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687526, "uuid": "872631d6-0c5b-4ab6-b84b-14a7c39f72fe", "comment": "Malware payload (Mirai)", "value": "0ac340123d2b9a1e91b66972a970cb940fd985824aeeea584a38d903be6f0dc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687526, "uuid": "97c829eb-cfa4-419f-91b8-c3fa57fe8a62", "comment": "Malware payload (Mirai)", "value": "e48ce28c7f4a0fe8ce8456aec4b95b0f202e2bfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687526, "uuid": "a91e39aa-e870-4891-83cc-6893204dbdb6", "comment": "Malware payload (Mirai)", "value": "8005121c55b24f70f0ca5b595948f66f0d8ff2db1811022d7e1dc4406395e1e572eccfa765f39094ee6e60b5680d5f21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687526, "uuid": "33daaf18-e005-4882-a76d-f81d1630a4cb", "value": "T1EEC3C71E6E218F7DFB69C23447F78B20A25933D626E1C685D15CEA011F7024E781FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687526, "uuid": "5ba02d9a-e56d-45dd-92e1-f719ba18c513", "value": "3072:kRFZhxNUTBaSQ3GnwkqPwxHF5os/wrmPjPdIOS5Xh:mxNUTBaSMGnwMFK4mXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766687526, "uuid": "09c4eab2-5a1a-4227-9ea6-8fafdfa55516", "value": 121768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766687526, "uuid": "03ffc8fd-ea46-426e-ac08-9fcc5d1d8d83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687526, "uuid": "e4c6ebf0-7e57-4918-b845-4cf19a491107", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5512d48-e133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766627265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627265, "uuid": "5bf06e89-c9e4-4d55-946e-c2d523c0a3bf", "comment": "Malware payload (Mirai)", "value": "c4c3624bd3e41dc538020fb64e20946e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627265, "uuid": "054875f2-adba-4cf9-a83b-d8a55f1bed77", "comment": "Malware payload (Mirai)", "value": "0ad6e6bb30705ba060b1eb8481b20d0a94c607449a2522c577120ca24fbe2f91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627265, "uuid": "4d17b9ec-faf0-48c7-905e-ed2a05fdd372", "comment": "Malware payload (Mirai)", "value": "20d94e12a2810567961ea70331033f338ee45a20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627265, "uuid": "13064055-9a45-4312-9390-5a2152947663", "comment": "Malware payload (Mirai)", "value": "c10226543e46ccc692fe89ee1cf730529272d615625cadb5f3869b95ccf6f8cc819d60032d641278102753abed2a75e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627265, "uuid": "d277defb-4394-4f83-a9fb-500c526e89d2", "value": "T1B593E706BF640FF7D85FCD3745B91B0525CD560A22A93B3A3A34D828F65B25F0AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627265, "uuid": "4d3a44b4-1ae5-4577-a89c-694a107208dd", "value": "1536:GrbDAThtrN2aMlsR+Hn5VbLDuH7ESKoZj+IoWLSPc6xJqVnT6u:GrgHNhMWR+ZVRdjJqlTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766627265, "uuid": "0a3cf816-04fe-43b1-9331-3a76541289fa", "value": 94232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766627265, "uuid": "e263ce20-553b-4675-8d89-020f0bce472e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627265, "uuid": "fa8b9912-fb99-45b2-8e5e-b1758b523c43", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72445362-e157-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766642614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642614, "uuid": "7bd0bd11-8930-4022-8cad-3ed918bd6c51", "comment": "Malware payload (Mirai)", "value": "6bf189bbb0b04a026062ac1516f90ceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642614, "uuid": "100187ab-6cf7-46e4-be9a-41dee88cc7f4", "comment": "Malware payload (Mirai)", "value": "0c53473ba82ff1985717f43bfbbb25759939d5e772e92da749d655d02d67d77f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642614, "uuid": "a219d3fa-2132-493e-82d0-5ffef9787ba6", "comment": "Malware payload (Mirai)", "value": "87e27e7568c8aa4297f60343e1e6662e0be0e2f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642614, "uuid": "86fbf239-7bc1-475f-9198-2abf248b5a02", "comment": "Malware payload (Mirai)", "value": "eee0623f8437c22466d71fbfa55898a45d350bf27649ec1b785a5a508ee3f021a9e96ff4fea60d67a10cf2fbb7123c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642614, "uuid": "8594ea4f-6443-4ba2-8907-5632c7bd2d5e", "value": "T18F343A87FD00CF7EFC0BE27244674915B130BF6A18620677F126BCE6AE291D5192BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642614, "uuid": "1ca30514-32df-4a93-8c8c-27bf5132d9c1", "value": "3072:3okxMqWz2gTijXVjpDrL1JzkyTgRlmi36CTprOiYggmA1UVdjbiHLH2RqlpSSc:3okCqCa/duyTElmiJTxYgZA1dLWeSSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766642614, "uuid": "224a9490-15e1-4c98-8350-850100acbd70", "value": 232184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766642614, "uuid": "4712f7d3-b511-4594-a262-abd2a3494c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642614, "uuid": "0271fd60-9f3b-405e-acb9-d94e73e531c9", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376e81b2-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641227, "uuid": "a378f333-8ecb-4ee9-bc91-2ce1c4d5288f", "comment": "Malware payload (Mirai)", "value": "277d5403b6c437061db75d4592a7ebb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641227, "uuid": "36cd9b47-d7db-4533-b31f-e46b1ad49f23", "comment": "Malware payload (Mirai)", "value": "0cffd5f3473dde6aecb03030cb95efa81c7e1a1bc218528dc318348af422c8cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641227, "uuid": "b6767ed4-29b3-4f0f-bf5f-63adbddb9257", "comment": "Malware payload (Mirai)", "value": "67bc9555319b4f605064cfe2b9dbf322129a7739", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641227, "uuid": "42064b8f-df78-4b32-b6a7-0998483d6bac", "comment": "Malware payload (Mirai)", "value": "94bb0bbd8a94af074a79a16c916d667ade5bdae8a91c6cd995607960c70ac614e164ab1872e62ed718148cbe21463de5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641227, "uuid": "816c8331-8296-436d-b1c5-5084772f3857", "value": "T109A3D60A7B650FFBD85FDD3B4AB91B0525CD550622E92B3A3A34D818F24B25F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641227, "uuid": "b8d8af36-726c-4ab3-bb4b-63fc9a96a0e5", "value": "1536:KLKwEtx8hxK9ZUXytxA9Fun1HYxrqZsi6JegUy0g8MuNpHQEN91Am+Tw:KDJhE9ZFMoHYasmYeATT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641227, "uuid": "a5b40a68-4fec-4b46-9329-fb4f41bca901", "value": 105276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641227, "uuid": "51a30ae1-7976-4e7e-97d9-477675463f66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641227, "uuid": "dc7242f6-8791-46a6-ac58-9faa789179db", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cfdaf6-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626081, "uuid": "5e2bd86b-610b-4a36-afef-2a122662e9dc", "comment": "Malware payload (Mirai)", "value": "3656a405067784e15d4430d23bec9a8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626081, "uuid": "4dd7cf9b-b58d-4746-bf99-543f058ad772", "comment": "Malware payload (Mirai)", "value": "0e296b89ece175baab9df3b832d6c9a028f2d62a8fc51fcc9c3950688e143e18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626081, "uuid": "f02b7430-980c-441f-a4d3-856e137e8f41", "comment": "Malware payload (Mirai)", "value": "2af2624b00cccb1042b764554bea62eaddbf4923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626081, "uuid": "ce0d435a-5ae9-4ab1-81ad-195dfab7fdf1", "comment": "Malware payload (Mirai)", "value": "8e9eda9740a6c418240df6cc41922cf07557037fb09057c101255a68748368c7356e000f25034a75e99c6a38846f7b20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626081, "uuid": "24a0eade-e46f-46eb-99d6-97623ad2c990", "value": "T12C834A21BD792E17C4D4747E21E34334F2B6274A25ACC61EBDB20DAEBF116503153ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626081, "uuid": "a7c09d7f-7494-4ee8-8042-5c4927bc414e", "value": "1536:vk+ZS/gZ7kiF+JB+kXZejbVW2KImVfud/YlgfEfJSEoIs/PTzAeZ:vLgTc+JH+RrhpYlgIJ7SPTz9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626081, "uuid": "4bb40541-f544-4913-8777-6000845f8937", "value": 84188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626081, "uuid": "427a27bd-249d-4a43-8707-d8ec47efcd72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626081, "uuid": "b23e8ca7-e3fe-4f54-864c-a27488887c1f", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1821183c-e1c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766691425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691425, "uuid": "71a59e17-4dba-463d-86fa-aa5b5b0aacf4", "comment": "Malware payload (Vidar)", "value": "66516308445beefb68926d3ea061e8d7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691425, "uuid": "91387767-125d-418c-aec4-10b5ffe18ede", "comment": "Malware payload (Vidar)", "value": "0e2d513b8d459d333ef0407d9ce027f586f8fd861bebee987e2137a07877cc1f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691425, "uuid": "7e8d7011-7957-4bf9-ba6f-0578f9ca6253", "comment": "Malware payload (Vidar)", "value": "d26a808bc0c4889458cef65bebdee44e85b82134", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691425, "uuid": "8f43eadf-950e-483c-a6b4-bf84b7482a60", "comment": "Malware payload (Vidar)", "value": "d822ac232fd1966d172cca56db4a14c8d87164a02c0afeb2959fa29ecce8b9d3e97535fd7a495f9329c670e8ea51d0f0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691425, "uuid": "333165be-8418-4b0d-bdbd-e2724a17ef9e", "value": "T13D1423A4986DE463D1269175309B0274F4D27C1FD3EACB24B9E0812FBBBF5EC5C42692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691425, "uuid": "fa50f3de-19dc-4f48-b5bc-8270a4203d72", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691425, "uuid": "1eb4b337-0011-43ac-997a-8bc4ae56ede4", "value": "6144:SJ228hOSs8Ow+oArZ6iJ7pQGZ77f74+PSvOjoC7Z6s:a8hOR8OwBArZtBnf0vOjN7Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691425, "uuid": "00bcbead-c150-4bf0-b30a-711ea93f6c14", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691425, "uuid": "dde09d19-1f4a-4cef-8a2e-baf364f65919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691425, "uuid": "7a485238-6e58-4f09-9ea2-2a99fd5b29cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f747b5f-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1766672942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672942, "uuid": "a712d756-a3cd-47b8-9962-ac7ff073834b", "comment": "Malware payload (DonutLoader)", "value": "9d4d646199f4600d6a926fe2e2b262a6", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672942, "uuid": "3a514686-5b18-42ee-9e5e-c0d5a9f1e1a9", "comment": "Malware payload (DonutLoader)", "value": "0f0e83c8dc8aa7bfae06cf61dd83c9dbe3786aedc1a26e43ff2e3914e556c8ae", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672942, "uuid": "c0cd99aa-6826-473a-a675-5459c11085a4", "comment": "Malware payload (DonutLoader)", "value": "3b4c0b21fae2144f61d07af3d10f87d97be8ec8e", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672942, "uuid": "877e1267-fe72-4c1b-8431-32a7a889d445", "comment": "Malware payload (DonutLoader)", "value": "192b1a286e7b4e84e0c73c7cd3cc1f31f8966096781c7691bdcc922288618c736810114c997bda1803556ca9eb4fa4f9", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672942, "uuid": "0ffc1071-12f3-412f-a673-5e148f4b1310", "value": "T12C36811916E52483945939FC6E2D35608C0A3A5FA2C32C9F76BAF4CB782DC4EE164F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672942, "uuid": "2c10232c-36e1-45d7-91e5-326caaba4a74", "value": "49152:fywdXPOF+s1+DVisRc5myu6NJTalN9K7Okmhmm4QhKprUfDzbiGVHN6JCelyO3f5:fnXLM+DVisRc5myu6/+K7rUrP2CGg2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672942, "uuid": "9541eee0-b19a-4500-a595-9c330718cc25", "value": 5228062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672942, "uuid": "9faead88-b480-43c0-a0e8-0b590166c6f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672942, "uuid": "f6c7d744-62fd-43b6-854e-505c51d3f081", "value": "statementofaccount2025.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e96893e-e1d0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766694631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694631, "uuid": "f291f0b5-80d3-4589-885f-5fcbdc5db3d1", "comment": "Malware payload", "value": "6caa7bea53e7b5056073cd9c908e8859", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694631, "uuid": "a9f929c8-6e2e-496a-9299-ad41ac3c1c62", "comment": "Malware payload", "value": "0f66bcdf70104d59e87e2591a556e980e75e2e7eb1846b9a16b91603a2894c8f", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694631, "uuid": "82559593-6a06-4491-9b95-7e4df78ed1c9", "comment": "Malware payload", "value": "f1ed37e89c3ed52c9c61b5c2daad542476f90e33", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694631, "uuid": "c8a01786-e02c-4db4-b5a3-d34b8e37ed01", "comment": "Malware payload", "value": "47f35fbc2f3d3c807db9fe9aea08fdd90271f3b8469fedb6e94261d640fe5935e1a71c3d62fe1c1b4047d2ad14be0e06", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694631, "uuid": "77f83c5f-ccec-4ae6-b7eb-1e43c6154545", "value": "T15097125B3C42FEE45A1C2D1C2EA8C83973B346D8ED566F99F4DC40343D516527A802EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694631, "uuid": "d8ceb440-1ec8-453b-b627-cfec4495b7be", "value": "98304:c8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8F8FR:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694631, "uuid": "1441677c-a15a-4c08-97b2-7a81fbb3c3ee", "value": 42720048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694631, "uuid": "64b1e4a0-e06e-4d9d-9b25-8abcf642c589", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694631, "uuid": "15375d9a-3364-42fb-8423-b09416da4a14", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d0a658-e159-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766643472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643472, "uuid": "2b7cd0ed-9ee5-4a11-a6e9-355189a44980", "comment": "Malware payload (Mirai)", "value": "81c636733770aa28348568df4505ee0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643472, "uuid": "f10ce00a-5a77-4387-a1f1-bb6ba0fe2232", "comment": "Malware payload (Mirai)", "value": "0fa7ae0bc71132a829aa595279ef2203c10e265c882d7ba4d046d619762f6843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643472, "uuid": "836e9ad8-f69a-46f1-b81e-ff8e7e24c06e", "comment": "Malware payload (Mirai)", "value": "2b5410f00e59303d79f5162e728fcaf7616eb471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643472, "uuid": "d0fa3f52-4c28-4b5a-877a-f1b3286ed9ba", "comment": "Malware payload (Mirai)", "value": "e9ef8f5160baade89c28d7b37c866177855e505396434aa3f4284856ddaec79153fef881c706669dc5b1b800d8e584e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643472, "uuid": "2c0f09e2-3071-4201-b853-e70250815aef", "value": "T155043802E603C9B2C41301B112F7CB765E31F9B7AE25D452D3FCEEA0ADA56D165093AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643472, "uuid": "85664054-4eed-41da-8cf8-5e9c65c45ba0", "value": "3072:6pvxSRDkRfZzYsjRV58c5aiJE7/CNDh7mU83glpy8X:yv3dRqc5aomu7J8uy8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766643472, "uuid": "ce09ecd9-4559-4008-a7af-882dc98d1ea7", "value": 184484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766643472, "uuid": "3870d07b-84d1-45ea-955e-c96d21471ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643472, "uuid": "ce33698a-4f4e-4f90-b520-ed24f34d2904", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221a6ed9-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690154, "uuid": "7e5a80e9-3550-4fd9-9bfc-f0080e0ce321", "comment": "Malware payload (Mirai)", "value": "38de5371dbc54885f18aa6c4de03af6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690154, "uuid": "c06d38cf-2318-416b-9b08-658b208b26f5", "comment": "Malware payload (Mirai)", "value": "0fc0c0aa10d7f989ee6709c50908144d95b2c62ad512419f690652c906db8ed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690154, "uuid": "3b6aac5d-1586-46e3-abb9-1ee9900f7bf5", "comment": "Malware payload (Mirai)", "value": "6653b3a3dc87f2b9663903b96549d2177326cbfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690154, "uuid": "df107469-563f-449c-ab0a-1b47a14fc5b8", "comment": "Malware payload (Mirai)", "value": "45284c8a70c6df051ec02622848cafd0a51e15893bbf3920b00b0e7cd2bf6bdc46e232460ebc10dc06699a0317f9c9fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690154, "uuid": "b7391039-5c96-4a32-9fb4-6fda2f431985", "value": "T1ABE34C8AF401DE7DF80BD67E44670E19FA31E3A13293172E529BFDA3B8311A54D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690154, "uuid": "949583c4-781a-4ecf-a116-c4de6ab2cec7", "value": "3072:hE8fXplvTYxUGIZZVMBwb6TqXWMgZXbsM9+f/SQS8:hXv7YUGIl2tqE5bsMMSQS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690154, "uuid": "baaf32ca-3d2a-40ce-b9d7-59f7f3b109af", "value": 147912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690154, "uuid": "b8e0bc9b-5d64-43b0-9b9a-c5e35a32fed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690154, "uuid": "a5d0e692-152c-4828-bacb-9cf41efdcafb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb554ff-e164-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766648134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648134, "uuid": "dcc1d5cd-ee4f-425a-9eaa-369515a5279c", "comment": "Malware payload (Mirai)", "value": "f6549ae508e058697d0ba91dffd94952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648134, "uuid": "402f2a27-a4f0-4008-bae9-b6164d3f9f32", "comment": "Malware payload (Mirai)", "value": "10373baf8e1a85334adbf51b67e28f9dabb08e0e24dc36eeb251c3e4952459e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648134, "uuid": "89617f24-2641-44db-9427-47101e4d2a8c", "comment": "Malware payload (Mirai)", "value": "b5dddefdddbd84d7f9b002e4cc39bf6994649bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648134, "uuid": "634f68ff-2359-4df3-8898-95be54d8604b", "comment": "Malware payload (Mirai)", "value": "6bb1b475f762db7e0f2403b9a4d66f5a0c238004bfe9eacc8a5f2fb0a1832c3582c3626eebd88fe97a85fe7daeffadfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648134, "uuid": "0b5c8c18-3629-447c-a050-20169d27f8ff", "value": "T16D045B22DD25AF8AC416A1F0B1F18E789F12BD2549470FF9A5B6EAF44143DC8F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648134, "uuid": "1fcd40b1-2c49-4b09-ae16-687a1b9090c7", "value": "3072:NHihjk6GE7VHjcMLjuvAfztkWzJW7kfco0yje7nGw:NHihjTGEJHjcMLj314Ifwyj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766648134, "uuid": "478f72e2-9cab-4cb0-bf4d-91025e6483dd", "value": 189492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766648134, "uuid": "76b113f6-950b-414e-a719-effd4f816566", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648134, "uuid": "e4077673-f11a-4804-8939-2708cf11e3c3", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2895a8-e18a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766664377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664377, "uuid": "e2349f62-12fc-4a23-8803-965a0b470c13", "comment": "Malware payload", "value": "0a10bf76fe9f974a98e0068c837a36ac", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664377, "uuid": "541661f3-e625-4119-9632-039693c7db93", "comment": "Malware payload", "value": "104be693d90bb024d60cfd27866a3802069bdd6ab673b737280f9b1e68b5b66f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664377, "uuid": "fed10967-1101-46e3-a07d-2629c2cace45", "comment": "Malware payload", "value": "3a9bbb6b2fe4405927ac27564afd2e91de671898", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664377, "uuid": "5715ba95-ae3e-42c9-9f90-3b42fb8d84ec", "comment": "Malware payload", "value": "cb5c1f58e4c513fed3c8615d3a9a1a2def94c49d66c024463da4e9b663cc4fb5bfe321ecc160fed86bf71ff392c8da81", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664377, "uuid": "04b5ae7b-5b19-4ff9-ad09-9e3fd7490b08", "value": "T1FAE1E796ACF32419741B405DCBBEA2187059905B870ACC9CFECC76A8DF4C6A49622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664377, "uuid": "b0352559-dfda-4461-a23c-81037124ed07", "value": "192:OZWhIE/CTK/eY+k0llHYoHsfOBro2Tc/OaSmy:OUX/z+ZYoHsfO2/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664377, "uuid": "2e2776bb-cfd6-4d14-ac13-e7a0e2b0eed8", "value": 7373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664377, "uuid": "d15d5a64-847b-4aa7-a864-c053a5ce7181", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664377, "uuid": "088f7962-c8b4-42ec-bd3f-28c3f2378bf9", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7b6aae-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626364, "uuid": "828bdf84-c294-4d91-a72d-b48be051525c", "comment": "Malware payload (Mirai)", "value": "18f796efef632df484acb8d192aff2ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626364, "uuid": "a9cd88cb-e93f-44b0-aef3-1dddb8cc2944", "comment": "Malware payload (Mirai)", "value": "106a3dac8950ef0bbfb4791cf3d8bf1061cb5a21b47d3a34ca77a3d42cb56fde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626364, "uuid": "5d841438-14d4-4cc9-94d6-e26c40a89ac6", "comment": "Malware payload (Mirai)", "value": "894623faf2ed251146c00811dbd7d7c6366a8e51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626364, "uuid": "6d5f5e2c-8a09-4d52-b899-8d1af84451ff", "comment": "Malware payload (Mirai)", "value": "361033ca50c270840938ddf23d80433ec3ea5a3a1a27a1e3234900bb2e79e878d829d2d7c0cac323d01fed600e70520e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626364, "uuid": "f8e028fb-bf82-4844-83a7-b980819a4053", "value": "T1D2236CC49A13EDF4FC5A4A742077F377AB75F47A1069FA83E3609A33A85270096062DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626364, "uuid": "eb48ecd4-c26e-4a09-97e1-06008c788482", "value": "768:5nmX03N75nEhdiYFUnUWi/Zz/8QtiYogqLvoddOrgkJO:5nN3N7AUnrihz/8QIgAviIrgkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626364, "uuid": "a92b3df6-21ff-43fd-ad55-c4da174b2160", "value": 46572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626364, "uuid": "4ac9db4b-0bd7-4a44-9a7a-a64baeb7f1b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626364, "uuid": "a19db8c0-d820-40f7-a7f4-888043ee6170", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd83d510-e19d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672859, "uuid": "1a3f1192-8829-48a1-8f2a-b651f42d9465", "comment": "Malware payload", "value": "f45b07aa8f1a7a688a3f061cfdd43904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672859, "uuid": "8362b56f-a9ca-416f-a0d9-8a1ba3e88ff6", "comment": "Malware payload", "value": "10d2716264bed25d09c472d8382520f3091ee42105042cf21d29ae7db836e1af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672859, "uuid": "6bdfef95-8923-4e86-bada-63c864037465", "comment": "Malware payload", "value": "af90cc7697e24c4da8be711d1090c61faed4943a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672859, "uuid": "d25be04e-a27a-4d66-9bc3-bc2e0798b2f7", "comment": "Malware payload", "value": "7c1010ae5a357a7d6dcd7cddb71870db24e875255e3f158bff20877027b0f54c669e9ce672d932df3140cfe47e1dac5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672859, "uuid": "c6493e58-5fb2-4007-a4e9-a7b520c3967a", "value": "T1C767332C1252A0A8D9333D74875AF09542DBB9F21ECB2A217F09E5BBCD39DD24BE5017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672859, "uuid": "e35bd575-2f19-4226-b3bd-77cc64b813de", "value": "d8b25d9f6e4502eb253a30096c76cb14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672859, "uuid": "bc92fc2f-6a54-4770-a71d-889a30f87673", "value": "786432:sr+dqyftxnUe12BFHuoq7lQUUuzYqGt3E6ffqazm:s6dqyftLKpuoq2g/G1EAqim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672859, "uuid": "00a96897-7278-4947-8f64-36a83a3a1804", "value": 30894471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672859, "uuid": "36bbed10-0d9e-4367-b90d-b8ef30621694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672859, "uuid": "ba6b69cd-09f5-43dd-8189-5b33871d991f", "value": "SecuriteInfo.com.Trojan.Win32.VMProtect.31303.11235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd8790f-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626363, "uuid": "e5ce70f8-847f-4ae3-b36f-ca73014ea67e", "comment": "Malware payload (Mirai)", "value": "98e14392e0601e4e3b783e654ba6eae4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626363, "uuid": "d9b434d2-486c-420d-919c-d42e62d4633a", "comment": "Malware payload (Mirai)", "value": "12db364f2cef06d7f610f3c253f907ab7e9e0b0f128d3ab21ca9c6c48163cdeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626363, "uuid": "ec9c8c75-b5fd-47fc-8133-9232c8f96e42", "comment": "Malware payload (Mirai)", "value": "39e20e8020f5d9fdc54febe8a16784d507d96aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626363, "uuid": "e5b08a30-04c6-4218-ad18-7575e139d999", "comment": "Malware payload (Mirai)", "value": "a853d3ae1168f1134782862d9d4d1a01b2bb77ff481f264c4157cfbb1d735c5fdaf8648f8ffa3d3f58a967a3118c3382", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626363, "uuid": "92922fdf-59e8-4784-acfd-185d3a6c8247", "value": "T1C763B50ABB254FB7DC5BCC3706B81B0524DC661A22F97B397934E928B64B15F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626363, "uuid": "6af943e4-cb35-4d5e-90c6-dfe7f1436fed", "value": "1536:p+P2uTXFksKmH7HGzijb/tKn5c9J380T:pRUX+sKGyNMXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626363, "uuid": "b64e2e59-b58c-4361-b387-66b20a644e82", "value": 68216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626363, "uuid": "abb835f6-04f2-45fd-9acc-2510a11d3254", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626363, "uuid": "cf816e98-a184-48f4-9b52-b8f2dd3de2bf", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd7b8ca-e154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766641321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641321, "uuid": "078db1bf-6b75-4630-b648-d7dd3f159aaa", "comment": "Malware payload", "value": "2e040de5c0fba110bf3cfe083614b34e", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641321, "uuid": "8f29365c-3004-443c-8640-ff2a742827c7", "comment": "Malware payload", "value": "1303bf5504a5d6c2a717815dc5a0aa36285cff6438f562d4928c47ec49c6dd64", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641321, "uuid": "269c2db3-f745-456b-a649-e64a41fad3c1", "comment": "Malware payload", "value": "c38598d8b48c7f516d326febf28c2a68f8979767", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641321, "uuid": "a88eaca3-6329-40af-9e06-118e68933e3d", "comment": "Malware payload", "value": "92ceb7e5f25af3eb0e011d8b10f90ded32327838bb183341176cd4f889a0ca31af556177c20bfb2c742d40589803b885", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641321, "uuid": "1241408c-81c4-421b-a64b-25a6230ef1c3", "value": "T13261B6702B6AD6EC05A615A50B7FD908023146132042EE9ABFCCC740DF9532A4BB87D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641321, "uuid": "849b90a9-b0cc-4267-8df0-3c4dc53adb05", "value": "96:jVAbCvQ1nQMErGo/1GYwhB/BD2goy4+ZYGzZK16W:jVmCoSMESxjpKgR4KlzZKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641321, "uuid": "f1f060d0-7878-4de5-a831-0120760016df", "value": 3336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641321, "uuid": "c8e8f9fe-10d8-45b3-a141-63033a231b2b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641321, "uuid": "30a35b91-4ea8-4b0f-8982-45e945875a06", "value": "1303bf5504a5d6c2a717815dc5a0aa36285cff6438f562d4928c47ec49c6dd64.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae74b1c-e1c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689417, "uuid": "16a14b1c-c731-4351-9b24-57da1d1cc31c", "comment": "Malware payload (Mirai)", "value": "4ff13d103d550a4fd9b1813a5d0f2f06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689417, "uuid": "0428e716-0e99-49a4-9966-c0c03403c9b8", "comment": "Malware payload (Mirai)", "value": "134c8afa7e48b6ae7f870718faf9e77a7968b1b5827a66e48f624a9702070937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689417, "uuid": "bcfd839b-3e66-4906-93f5-710d9f68d3af", "comment": "Malware payload (Mirai)", "value": "845c75233738cae76d55c58c71bc56a325ab65a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689417, "uuid": "1a0819a3-c778-4cb9-9e5f-2bab1fdde3b5", "comment": "Malware payload (Mirai)", "value": "b7a78bbe4bd3de3ef97deb2c7b59ff713f0b659c892ffb40b925f880dbf78bfb34cac114839c09288a944143a07f2307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689417, "uuid": "8004711c-0d53-4847-818d-ab2edbd1f711", "value": "T1D0933ADAF400CD7DF84EDB7A8463090AF631A75115830F3A225BFDA76C321999D63E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689417, "uuid": "dd44b424-17ca-4740-92af-cd34b61eb6cd", "value": "1536:cDm7SQmQHpUsTSDpISwb+JQN5ZsXqMLf7UMi280xAb28xL+0PS74TPzuFmcEKk:BJTSFr62f7UMiRb20q7u6EKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689417, "uuid": "7d50ad82-e913-45df-8aac-2f3a09b72d01", "value": 89140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689417, "uuid": "ede5f405-b019-4dfb-96ef-7015e08596e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689417, "uuid": "90079485-31e6-41b7-b175-b18a46993280", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04adb2c5-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665193, "uuid": "1c45eb5e-13d4-4bf3-88bf-562ac87530aa", "comment": "Malware payload (Mirai)", "value": "077b7ebc40d02f06d45017463249442d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665193, "uuid": "f0b439c2-03a1-43f5-84de-46b5cca6c6c2", "comment": "Malware payload (Mirai)", "value": "135e9526a75a9fdf5aab61c0ee6455c52a4feec33bacc739481f7fd89650b3e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665193, "uuid": "d49e1990-c6c5-4fb5-8296-330a674e1db4", "comment": "Malware payload (Mirai)", "value": "b2d9a617fd570c5ffcf9dcfd2c13da82b3b81dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665193, "uuid": "24ba4a8d-6d4d-4a13-98bf-425d3c50c63d", "comment": "Malware payload (Mirai)", "value": "e87e86bf04294125855c0cc1da853a09cdd6005012b6e112668664a9a440a34177995118b0dd56ea1854ec5d216559ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665193, "uuid": "92dfb708-84c9-4a2e-b40e-66f2f809df57", "value": "T126734B1233284F53D1579EF018BF57B083EAFC9119A6B188950FEE954235FB2254EF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665193, "uuid": "074e08da-fbd2-496f-81ab-3cb5cb55e4df", "value": "1536:uzrPBREYew/FOU/Xm3rPoVXqN0+svQo40wA/X:CPBRdNbm3rPAqHs4f0wwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665193, "uuid": "373cc038-2dc8-4e6a-95ca-6e8a7c958fe5", "value": 76062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665193, "uuid": "a8d96b07-79ab-4b49-b1c4-22fecb966bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665193, "uuid": "8ba9f070-6494-4b28-9b63-95ad5a11c618", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37f0310-e180-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766660386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766660386, "uuid": "317988e8-2667-447e-823e-d8e89ec1f39e", "comment": "Malware payload", "value": "68697a51a25debdb55e08da79734d1f3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766660386, "uuid": "6903ef0e-44f0-45ef-aad5-aca020f28dc0", "comment": "Malware payload", "value": "1389e203ecaebc0b44365ebcc95c05789367e896e862f1a2f614e29ded7d6c01", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766660386, "uuid": "682e4d2a-26e6-4b75-8b79-8e3fb935a2d1", "comment": "Malware payload", "value": "160b06312371027620b7cd8e02e531bdd01ce4ee", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766660386, "uuid": "7943032c-9a80-4b68-b007-0d431d634f1a", "comment": "Malware payload", "value": "efc756976a2900affd4afb34d098ca46ffda546c14e45df8061ed32e72e4848cd4eaf97d37b4828ead091c0be888f6be", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766660386, "uuid": "79b7998d-cd86-4eef-ba0d-f62a2ce92c4d", "value": "T14C5633ADC139BA39EE0ADFB95812C47456C127A87204389BAF1617AF4D207ECCB547DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766660386, "uuid": "dc222d98-76c0-4aec-9fe1-0bfcf9eda96a", "value": "98304:JUGHtARvlSx9ETrrTw9gPxyh1pUY4MuMkR5HCcCLujdpWp00bgXt2:J7wlSLETrrM9ICFVkTicgapWbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766660386, "uuid": "8d454908-9daa-4f81-976f-31f68945cb1b", "value": 6142092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766660386, "uuid": "2d714763-2782-4e9a-837b-42c9b993c282", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766660386, "uuid": "993839e9-abd0-4fc5-a5b5-808f21c794e3", "value": "dropper.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac71f0f1-e151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766640135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766640135, "uuid": "2ed596e3-d936-4177-8b2d-7d3a6bdb2d9b", "comment": "Malware payload (Mirai)", "value": "0866dd663705fc675f8692f499835c4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766640135, "uuid": "801cbe1a-4a8e-4739-b765-54d79de4429b", "comment": "Malware payload (Mirai)", "value": "14754bbe27ebe7bd817047e0acefa8b9f3bfc373a26fd88aca8cfb556f500aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766640135, "uuid": "322e95bb-0719-4ea1-a101-622d472bba6a", "comment": "Malware payload (Mirai)", "value": "1365c6e2f00637caeb7df85fd208230d3a50a8bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766640135, "uuid": "7a8b29fd-e082-40df-96bd-09352cb8d41d", "comment": "Malware payload (Mirai)", "value": "738135f53d7cd2e83ceadf4b4043c77bfed7d5d0a4daf781c9105f2b17bff4836d793e12f06f30c2146c74b1569b68d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766640135, "uuid": "6cc90321-7a80-485a-909c-c6c6575b18f6", "value": "T1E85329C7F800DEBDFC4DD337C58B0A15B630BA5649921F72B26BA967B975084483BD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766640135, "uuid": "fa430c3f-22d1-42b8-bed5-49a89605a48b", "value": "1536:uyFAEls6ZJjPl4n8QtgJ598jXzv8Pom1W3y4:fAEdJjd12jDv8PowSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766640135, "uuid": "c71e783d-db53-4a81-96b6-77f29e35cc47", "value": 62352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766640135, "uuid": "dfba943e-27fa-4cfd-befd-550dfc43d44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766640135, "uuid": "1d39bc45-8179-4389-b768-e5fae431c7fb", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22256b8d-e193-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766668249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668249, "uuid": "dd005c53-815e-4421-a562-a19570c859d0", "comment": "Malware payload (Gafgyt)", "value": "f472c9a409f62d3f1327ffc18fe33da9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668249, "uuid": "71c33601-09d9-4be3-9678-51847e4e17b5", "comment": "Malware payload (Gafgyt)", "value": "152e82c6383a68baeb5a453ba03c4ee910c53765ea9d93ee042af548d607add9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668249, "uuid": "ee19e947-8251-461b-a3d2-ef4d038c4465", "comment": "Malware payload (Gafgyt)", "value": "a506841b1b182f3fb33f344f9c04b9c1157c38ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668249, "uuid": "ee722627-da21-48b8-bada-3dc339b57b8e", "comment": "Malware payload (Gafgyt)", "value": "4774c15528c15a145665189b44586076a3694c8136501474bd891fced1c6903214675c12f22c96e7d72852ab663e5a4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668249, "uuid": "08d8385a-0391-470c-aa83-5b4eb68e60cb", "value": "T160121888FAC482FE26E749D611D38B7C4E2882E064738DB6DF4894F2AD7844F605F761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668249, "uuid": "cde1fe93-7e48-43ba-adf0-12a54ad65e7a", "value": "96:Ax0iRoLngD0J5StYf+d83foYjOoeCuNXPWo+Kz:g0goLng8eCyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766668249, "uuid": "f8c5def5-deb7-442d-b7a1-84a5645c0739", "value": 9432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766668249, "uuid": "59cfcd76-b620-4555-98a3-de5734b1db99", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668249, "uuid": "4a7005e5-88ab-44f4-9863-e61e1289023a", "value": "rondo.aqu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728993c6-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666237, "uuid": "d4451da3-392c-40ef-9a2b-60523d6a1c41", "comment": "Malware payload", "value": "1ebf69bec958763e420691a856ba1e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666237, "uuid": "d336a0ad-435d-43ac-b108-6186e97f8aa9", "comment": "Malware payload", "value": "1586e6f714547d9ec024c9aeff1df7024d37a867d543de418b0af65c530c6738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666237, "uuid": "6cf4ebfa-498e-404e-a6e9-8657e56ed939", "comment": "Malware payload", "value": "4dd8ade66c5966282097e0c69abe1cbcef12e393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666237, "uuid": "682c1f34-d735-4c3a-9865-f8f5491f6df3", "comment": "Malware payload", "value": "c5ff1222fa4927c02d79811a8d4221b52517159e6e73c3d973517820645df30cc14cecb82237e3c5c4209586e2c2efbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666237, "uuid": "680ed444-9ef0-4ba1-962b-80f2be2bf82d", "value": "T1A9544B4973A440F4D9A79139C9A39A46E7B2B855077193CF03A443B95F3B7E09E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666237, "uuid": "4fb5617b-16b8-4bf2-86e9-0931aad74502", "value": "b31da0971f03ad8d978723cd8ca7b5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666237, "uuid": "b925d102-297b-43db-bf07-d3da0997bb5a", "value": "6144:T5tTACTcSFHR+2hUNtjhQTHqmTw42sLX/wY+Bf:TnlDIhQfYY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666237, "uuid": "ffbda5cf-ca05-4049-b7aa-145d6df2db93", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666237, "uuid": "6d9abede-eb7c-4b63-8a15-7a5bf085ce1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666237, "uuid": "2fc29058-41e6-4f3d-871a-1519f9ae7ef0", "value": "1ebf69bec958763e420691a856ba1e3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c6faae-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626077, "uuid": "6d03e24e-842e-43c0-894f-7cc589353849", "comment": "Malware payload (Mirai)", "value": "e4ee0220e73e0ab547aaf227dfe19989", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626077, "uuid": "a0b7fb42-993f-47b5-8cf4-52d763db07a6", "comment": "Malware payload (Mirai)", "value": "15fe9e1f028f0f5b3dcaa8f1bd8403d658dc22f986b9dff2ca60ab62ae45165c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626077, "uuid": "b611ecb4-6e51-43dc-a239-63dd595d45d5", "comment": "Malware payload (Mirai)", "value": "dfd98bef7e34752026e040668cabfed79ad67b4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626077, "uuid": "b90e9bf7-52d0-47a7-bd01-b3c92394feec", "comment": "Malware payload (Mirai)", "value": "516b759c1d0b2505de5d2405a95fa4849adf80e89719a64584bcd96079b9d09e01a843a2a3ceba1e76e4c9f7f51461c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626077, "uuid": "30144ed2-0629-415e-a4a2-67e9c6f345d2", "value": "T1373319CAB8029D3DF91FE6BA54164E0DBA3177C111830B2767ABFD937C721A85E02D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626077, "uuid": "f757c2eb-4409-4da7-bbed-71337e45688a", "value": "768:zIPq4mGrLNtsbX22lXJwTc826Mt51zhhFXOPdSns2Gg:k5sz22VJAc826MZhhFXydS4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626077, "uuid": "8a5bb6b4-0c36-4fba-aec1-def38293a75d", "value": 53472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626077, "uuid": "9af5c536-f86d-4b19-a0c6-3b2ded0d19df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626077, "uuid": "478ac4af-a0c4-442f-89a7-ad87650143d1", "value": "0.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00367b59-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665186, "uuid": "7c09440c-c63e-41b0-a3a0-56a61a0b2c98", "comment": "Malware payload (Mirai)", "value": "e0c0157e93de7a9c1d367e46128bf64c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665186, "uuid": "25fbd4db-4db3-479c-a477-1baf38fb3234", "comment": "Malware payload (Mirai)", "value": "1680f42e50316eaa53140c33bd347b75278c7d4e80fea80fa290d5f41357732c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665186, "uuid": "abb6a139-510f-4185-94f2-7fa8a116419d", "comment": "Malware payload (Mirai)", "value": "e5f420dd0faa8f4c2af0356556a4ef1dfb9be556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665186, "uuid": "a7f956cf-daf6-4c58-a19c-b3b9a90ce121", "comment": "Malware payload (Mirai)", "value": "a34907de110333230c534926308b05d72b382ca85a214b5451c7e8597596875dab73c11970236c5bdb3884b7148749aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665186, "uuid": "0bc1cb8b-1026-405c-ac87-5338bb53fc40", "value": "T102638E23F8959FA3C1859BF4596249386713F81A5F532E7A691DABE502039CCF90A3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665186, "uuid": "7fe3a462-6717-4c3a-b40c-e637c9808269", "value": "768:clph/ty6Eu+39umtP2UBoijNP3MWVb//LMj3FvvpUnxJQZG7TvtMZP5oXt3CcmEw:cls69I0oPBMhj3F32xJhqp+93CcTunnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665186, "uuid": "30023a85-d82b-4542-89bf-b8c4412b37b5", "value": 73308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665186, "uuid": "8ad732cf-0db0-468b-a9b6-138919727b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665186, "uuid": "580ab46b-0258-4426-bbfb-4425677c223f", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f071ac4b-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626075, "uuid": "5836c1f8-2a3e-4b77-9cc0-60aff23a35c1", "comment": "Malware payload (Mirai)", "value": "757e843f15ee5d760da0012518dfdd3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626075, "uuid": "ed87926f-0dfd-4559-b81f-24229c58cd3d", "comment": "Malware payload (Mirai)", "value": "1756e31fc7f80e4f10bfc0d0d43bc91a448d70a1b8695de90a28bfb9d3da7b9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626075, "uuid": "a8fcb561-e318-4fb5-89a3-55f3c9ad5942", "comment": "Malware payload (Mirai)", "value": "5576d42e691aacd812038aa428e8c6283fc53c72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626075, "uuid": "7406bd84-e80f-4fb2-ba0d-d5c576a9f63b", "comment": "Malware payload (Mirai)", "value": "65e301c6b6000558e087c7c6ef120151d9664b3832959ef59f7b90901b80d66c5670379ee48ed51b6be44c9c7e56c9c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626075, "uuid": "00d4c801-3125-4007-967b-2e1b1143500b", "value": "T12623F1274BAD4CF3C73944F6F48F8E626AA60EBCB25C306607A141317ED926091F95DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626075, "uuid": "b29f58b7-aeac-4c53-bb2d-cf122beba6a3", "value": "768:FIPyGLHYwzIRwMDpcC5HVpdLFR09q3UELU2yAfodLXtTzFuvp/fpxNM:OkwzIRxDL5HfzLU2bfodlu/xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626075, "uuid": "d66e246a-3ea0-46ff-a19b-3bebd702a0be", "value": 45984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626075, "uuid": "40450663-e0f8-4b76-a4fb-345bdf3850e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626075, "uuid": "a47ff744-9648-4347-8173-2d6fc11e5af5", "value": "0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e149ed8-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672967, "uuid": "84b938f9-a410-46ee-967e-67d91da582c3", "comment": "Malware payload", "value": "ff940a79d022d98483669797ba7dc2e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672967, "uuid": "787cafc7-b7b2-4164-8809-aac0e89a668d", "comment": "Malware payload", "value": "19362b936fa83b507a69b9114ee44da7e6066976325d67dc1a4b5ef4b1eff9da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672967, "uuid": "8b4b739a-154f-419d-8db4-87891858f11d", "comment": "Malware payload", "value": "4a3209be19b719f0f60ef74d1a4fbe34145fd327", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672967, "uuid": "0698b337-2107-4cd3-9ef5-1921c132beff", "comment": "Malware payload", "value": "48af0ea00bbfcf8a1bc7d0509985e2ba5d9d5f53e199ab6e48a674a76983569dd4565d63f2535ef1a23fd3cc16e5061b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672967, "uuid": "dd1e57a9-8bf6-4db4-93fa-d4123cec09b2", "value": "T16E13B8CC3FC7B06493512063192FA09AFA1E4C44768C44A1E76759E4F92C728FB7AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672967, "uuid": "424e58a5-fc5a-4d70-bba7-77529d115793", "value": "768:4iuG+ux2GP550h74gBiG+na3vVX6rx987KsxzU4W59PcsEwnQ7fxRBL:4iu1Zo0h74gMAR6rx9xsBJW8AQNRBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672967, "uuid": "01686b8f-c87c-4736-8e97-c54c4343d43e", "value": 43019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672967, "uuid": "8b6c4eb8-7294-471f-93e3-cf6408573739", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672967, "uuid": "af7efa9e-4d1d-46e3-857c-b9decc19f4a2", "value": "SOLSINGAPORE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b10266a-e12c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624133, "uuid": "67748fec-f48e-40c4-a981-46f72d4a28da", "comment": "Malware payload (Mirai)", "value": "8e6e022bf731d060c065e07bfb526eb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624133, "uuid": "69da65bc-ba94-41e6-b353-e8345b70f952", "comment": "Malware payload (Mirai)", "value": "1a9cd08680adf2f14806a8268b6710cee2b18ac046c912be5fbee54fcaebcf80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624133, "uuid": "5b4a0090-cfd8-49b5-a9bc-43df52203841", "comment": "Malware payload (Mirai)", "value": "911935a9984d7edeb0ba9d7604dd0bbaaefae29a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624133, "uuid": "8259a6f3-8f99-47f6-86c5-1bc92701a24d", "comment": "Malware payload (Mirai)", "value": "3129d8cbc9c1c2067ef3ac7a7f2ef785843ffde40d5215cad4ec417c9ddbbffef259e88e198b71487be01cfbfaf55f51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624133, "uuid": "3098b379-1bcb-47f6-b953-f16103f36d06", "value": "T16AA3C61A6E129F7DF768C33587B78E31A75833D63AE1C641E15CD9005E6034DA82FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624133, "uuid": "6f5679f4-613f-4dd8-8be2-ec3dd498aa72", "value": "1536:vprUit+I4kSdLGiB8uDAONsFkgnv5iK8yKm0yKK6VGcsubGsD5zhQrkaTwr:1UY+rxB8uEjFkgv6p3DNakaT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624133, "uuid": "a31157f3-b833-44ef-8aba-b92c1b67ac47", "value": 102268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624133, "uuid": "2d733e50-36aa-495a-a173-453357097cc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624133, "uuid": "6d32dffe-a262-4d42-9e13-92825f0c1011", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcb5c6f-e1d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1766695700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766695700, "uuid": "33d8dda8-9fca-47de-8ee4-31a9e449d614", "comment": "Malware payload (Adware.Neoreklami)", "value": "35acaeebbcd497aeb296c6e6cda42743", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766695700, "uuid": "ba207194-3d93-4bc9-951c-7d6477b45849", "comment": "Malware payload (Adware.Neoreklami)", "value": "1ab483b14eba540ec7a1283d6a8228efc623db43efa59d627229d3385064d35b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766695700, "uuid": "6d3ede0e-f6cf-4549-a59d-5124cd496a57", "comment": "Malware payload (Adware.Neoreklami)", "value": "c4bd546881819d2b6fb0132cf635932e34d5b8c0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766695700, "uuid": "d613b430-ea93-496e-bd66-97513eb2b054", "comment": "Malware payload (Adware.Neoreklami)", "value": "fb6a0ac815a1d25983739104fe71fac72b48faf276459877a57a8c9af817601d21395f6111fb174c74ee92ebac806662", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766695700, "uuid": "c8446ee5-2ac6-417b-8633-3e22aa67f24a", "value": "T1A876335276ED8CFED1A5A2776C684FC1E6DAD9BC8E3016231308436E0C2D9A5D98FD07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766695700, "uuid": "ec78d71b-549f-49b2-996b-b7d34705e525", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766695700, "uuid": "a81400d9-68c2-490c-b26b-e277826fa630", "value": "196608:P1O2ElG058osiIVKLfqu6sWFOZDXaa82WvZ:tO2ERVsvVKLzWFOh8dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766695700, "uuid": "dad7e10b-97f6-464b-9562-df63de7992ff", "value": 7504013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766695700, "uuid": "c62b8a50-8d69-472c-95d8-789d43ee8189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766695700, "uuid": "b5c9a07d-5d6c-4be9-82d0-941c416316a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4542b533-e139-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766629653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766629653, "uuid": "759b531c-3775-462e-a040-ea20a234eb57", "comment": "Malware payload (CoinMiner)", "value": "5c1a89b8321ee6860904a4b4b50369e2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766629653, "uuid": "73893d5b-4f6b-49c8-85a4-232d49726401", "comment": "Malware payload (CoinMiner)", "value": "1b95497b3247ace77bd2c28c96803a47f69ec7d35ad84dde377d1ee3684193c5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766629653, "uuid": "a86f2f4a-eba1-447b-afe3-9ed3ed395ddc", "comment": "Malware payload (CoinMiner)", "value": "47486921755748e7233c75bd7f247ef71a311b62", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766629653, "uuid": "66263100-d994-4062-b262-9573c9e86d9f", "comment": "Malware payload (CoinMiner)", "value": "013819e1f98f81c02b74ae7cd7cf0c7d76b18d9974a79a51439b32a755b7a8748bdf70c62e7bd72d02cb506605ffdba6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766629653, "uuid": "440a4a52-8825-4a79-acb3-fa0b080a14fc", "value": "T1022633327EA5A0F9DD9303714EF08EC35DE9FA241F3906CB4B842C57B6266C6953E186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766629653, "uuid": "b7f29334-be34-4c1e-9072-3d625b525f9f", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766629653, "uuid": "d8e72c74-f461-48aa-9f55-db153829173a", "value": "98304:8P5Hiumpi1h7gpajXTyHp7garhhKxXwPhLvC7QNw:8P5iummh3HyJR2XwBKQNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766629653, "uuid": "9203a13e-fe18-4433-9e5c-33c2e3ca5d3c", "value": 4860024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766629653, "uuid": "828a382e-8289-45f0-a199-ba581d0655cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766629653, "uuid": "752c17b7-5f06-416b-a267-b4990532ef6b", "value": "Driver_EN_msc_AMD_v22.39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9e558b-e1ba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766685180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685180, "uuid": "2b1e1820-850d-482c-a0be-21251d55c363", "comment": "Malware payload", "value": "f465c9621004eea86e71454bc8ccd8ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685180, "uuid": "2abe8407-ccb1-460f-ad08-60dfea58d3a2", "comment": "Malware payload", "value": "1bba7bba9d412b0515fb3fe2ad9bc053387b0a52349002860b0ec3f54cc499a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685180, "uuid": "73c618e8-2060-4aa7-beb0-6080cc4a16db", "comment": "Malware payload", "value": "7c8c910f3b21b32655ab68211cddf129443eae05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685180, "uuid": "df3e7126-81e0-499d-b33a-42e70cacd524", "comment": "Malware payload", "value": "aeef9e9b627312df3e021822b9b34b1307b7223fa6e91fca37ff68b93e3082f3a22583ae6b433427ace3dc3f0159808c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685180, "uuid": "bc8e02c2-087c-4e22-b2eb-b5674c5570df", "value": "T1DB94E0A6FB023E46C8D7C53558C58286964DE45B37F393863A035A7B382E7378F68385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685180, "uuid": "a2a4d32b-d246-4d97-8fe8-3209078edceb", "value": "6144:U2iFm2LVffDxiY17yUW+eGxukk361ROKVSsduKU5BE8pRM8Z:mm8DQY1GUGGxbcsduKUE8pRM8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766685180, "uuid": "40c00227-2533-4c30-9518-6b7849446b8d", "value": 416204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766685180, "uuid": "81eb709e-307e-443b-a437-37e67dd8e929", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685180, "uuid": "f049633f-417b-464f-8fe2-bad226494943", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4ec243-e189-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766664084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664084, "uuid": "536d5572-c2ba-4a41-9144-21906abb92fc", "comment": "Malware payload", "value": "dd60a7ae8a78a91fc30edec215388210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664084, "uuid": "956e5bde-6dd2-4e9c-9a30-28b307f8c33f", "comment": "Malware payload", "value": "1bbf4028ba1e8eb11bdaa7317c382879da0a14fbb727f01b44c93f7950d26845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664084, "uuid": "3992fa71-a7ef-46f4-97e9-e9f21cdac72e", "comment": "Malware payload", "value": "41de6231db55e74c604ab80279548ce6004cb8fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664084, "uuid": "5ab8a8f1-f477-4b35-ae5b-aac672da0ac2", "comment": "Malware payload", "value": "a48de3c9337984d2cffb00ea5f1d399280f6dab63423b97d24689d1f457f9efba930f1f850fdf2a3f74d50d024812766", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664084, "uuid": "b8b3f37a-468f-48d0-86ae-10be034f29fe", "value": "T14894E0AAF7123E55C8E7C53468C58186A74DE45B33F3934A3B02597B382A7378F28385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664084, "uuid": "af7824d9-b17b-40fc-a3d2-2334c6cef9d8", "value": "6144:LvYPqKeQ/M+vOGV20zcoNAyztNZGKE7RT4ljtBrHXKUTSk8pRM87:LQywdvzV2HMPNZH7rHXKUT8pRM87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664084, "uuid": "a67a63c4-bc90-427d-91a3-6f1e785fbb2c", "value": 416252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664084, "uuid": "d2a10a28-a436-479e-a7fe-a0c75b3c9dc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664084, "uuid": "192a2d71-a279-4a04-968a-8280ddf3ab17", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b73e62e-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626121, "uuid": "e85b2c5f-6b60-404f-bdd0-d5fc16169573", "comment": "Malware payload (Mirai)", "value": "79c19300df2f747b4d0cc585284c75cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626121, "uuid": "cf15d8cc-5c7f-4fa5-a6f8-7b2836c21f94", "comment": "Malware payload (Mirai)", "value": "1c2f1c37fcc5f26f59a8611aaa487ae33e468f85d28e7367005533b804624563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626121, "uuid": "8dcab1d0-3f41-49aa-ba16-85eee2adaf9b", "comment": "Malware payload (Mirai)", "value": "11e3444f07d7c7dfd135d3d83ee565c7158d97f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626121, "uuid": "2d2f4a21-08fc-4530-a483-0d9c9229ab6b", "comment": "Malware payload (Mirai)", "value": "afbe66d86510a97a8edd8d808dbd6ce5fda9a56bd2119b5eedf4f441eb5a31bf467e1bd21fa4e6d25069ff09aaa62f60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626121, "uuid": "80b84de9-0372-4ea1-9dda-404c1fca38c8", "value": "T124C35C46FA418F13C0D61779BAEF424A3322A795A3DB730699249FB43F8675F0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626121, "uuid": "ac5d90e8-daf6-4506-8e44-ee910aea0961", "value": "3072:XlW6obDrXNaoY1styKKIlTzzooYrHFRM/9qdn4QiX:XlW6obDrXN9Y1styK9lTvRYrHDM/9q5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626121, "uuid": "cdaf4274-fd45-4eb7-8038-33afcd79e3a2", "value": 128114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626121, "uuid": "57792e17-493d-4ab8-a068-fd3535aaa51b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626121, "uuid": "f131d137-8bff-4556-b083-d821adc5a64a", "value": "0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48103076-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766694083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694083, "uuid": "d00a153d-e037-457c-bfc3-9cb2b5806c46", "comment": "Malware payload", "value": "ec582a1a9b57879e3fa451a5bd4c1425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694083, "uuid": "1854f59d-b6c0-4417-9320-a48f9e0e20cc", "comment": "Malware payload", "value": "1d50fca32dc1d90ca0bca01a7e80c1350bfd325b93c632e9bfaee993929197f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694083, "uuid": "56c4c85d-4bb8-4238-91a1-e0b61ca5a42e", "comment": "Malware payload", "value": "452544e18ad0d6749dd25a531b6132429cb1e162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694083, "uuid": "f708deea-1ddd-42c1-8c18-83a85907c0bc", "comment": "Malware payload", "value": "4c73975b05ffeb5d7138326e8e0a1f84a85a04ca72ae9321bba23e1e24affb9be3cebc76efaad1a4dfb34ab8a3344503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694083, "uuid": "d52e65ad-a170-419a-8614-e89d824e565c", "value": "T158C41A7DAC60F362F608D0BEE185D3529E2178110236AAD319BE932412459B3DF5B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694083, "uuid": "9c46140e-a803-4969-afb6-b2a06647b067", "value": "ec4a3e507f2cadcaf4f3ba70774863e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694083, "uuid": "9a75aa0e-182b-41ee-b1d1-91b82550be67", "value": "6144:3iy/0WhBGtUK8z88VeLQiI8MvCobILNkJnDCikykXhCgp/1JsUzvE4w6JOOunamb:tcDv87KkkykT/sUAgsdBiBNlin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694083, "uuid": "1940e1b8-898a-46ce-917b-54f7a05395c5", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694083, "uuid": "a837f132-321a-4d45-9aa1-d2fd9f5e7bfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694083, "uuid": "ff88d0f5-1d24-44b3-b22e-4fa1ad50d9d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4641c1da-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766666592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666592, "uuid": "d1938850-17e5-46fb-9c0e-64c3d324f71c", "comment": "Malware payload (RemcosRAT)", "value": "db1df67a2a44d6fbdd7232551eb716e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666592, "uuid": "50c4725f-63f2-4cf1-a249-174f4f2919be", "comment": "Malware payload (RemcosRAT)", "value": "1e09010334a0759862dc748e4dd2a78110603bdb6731495ead2c5d6fd64ba597", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666592, "uuid": "1ee7225a-cbf9-45e8-8db6-32097b9bdb97", "comment": "Malware payload (RemcosRAT)", "value": "33e54cd0ac006db39f3f4d8882363d523bdc4749", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666592, "uuid": "7058e55b-8891-400a-b68a-1f7da28b6cd7", "comment": "Malware payload (RemcosRAT)", "value": "327fbb13579a97124b0e086a393598564c89c3d409c224fc3bad7d2400968dde1296c175250b78266492a92d0b408589", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666592, "uuid": "c42c31c3-bcf7-4537-9eea-7abed43b0a62", "value": "T1891658D22355A11265A04A8BBFAB435CB452449D0813FD3F7BDB31DE4FA6733BB29920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666592, "uuid": "d9a37cd5-327b-4447-8eee-9c623a09f0e5", "value": "3072:SuEP9JvjwJCWrAxbwzZ/I0B+oX3bHlX1jMBG25MIORQhDK9Rd3f3sVEwvfbVz/EB:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666592, "uuid": "8d60c321-ab1a-4e85-a692-e9fdbd00b4aa", "value": 4126643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666592, "uuid": "f5435e2f-0b87-4684-bc46-8e381b71af37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666592, "uuid": "ce182521-8858-49c4-8d99-78069f074fb8", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f533e3ff-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626083, "uuid": "43e0aca9-2640-4b3d-b627-a8c14b561c8c", "comment": "Malware payload (Mirai)", "value": "3fa577c83bba027dba0bac08235ff390", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626083, "uuid": "9f568024-353a-4a7c-872e-be996894b3df", "comment": "Malware payload (Mirai)", "value": "1ecc3d2370080f75cc490c24be2bbc7657e3f4a5f0db1260c5b9d19641c539c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626083, "uuid": "24daa138-e092-4b48-9129-29f5d6c46244", "comment": "Malware payload (Mirai)", "value": "5713ff81d2776cc35f872e2d3ad89674618f520d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626083, "uuid": "009b14c1-1f58-4172-adc9-93dc8f00588a", "comment": "Malware payload (Mirai)", "value": "2d6cfdd014c76d7acdae6df86dc4ae97251ae341f8bccadc78f1898d29d015b99608205b5d8abec447d7996e427f960a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626083, "uuid": "90e88e68-2364-47f8-8849-be2b56a4abe1", "value": "T1E753F846BD918B15C5D412BEFA2E128D33232778E3DF7212DE116F25778A52B0E37912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626083, "uuid": "359bd9fb-4d0b-4465-850c-93c36eb530e7", "value": "1536:2hnK4Gd07/Wqvy0vB5mlTfXkiWDXyB3mmVf1boMFiL8SZV0qT:J2HElIa3mt8SZV0qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626083, "uuid": "eba0d72e-a07b-4d60-9a50-ed38effcb888", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626083, "uuid": "2e40b58a-04a8-40e6-a627-a30cd3cfc3e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626083, "uuid": "61ebecf0-b6fd-4227-84a4-e6f64c74bdd9", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42e1f8c-e1ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706719, "uuid": "dc623a00-4517-4ba5-8cad-1d691ba7cf74", "comment": "Malware payload (Mirai)", "value": "65f23c0b075661b4498f3b0d86ea43b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706719, "uuid": "79aebf1f-c0ad-4874-be3a-f0bcdb27acfd", "comment": "Malware payload (Mirai)", "value": "1f7568ab8d81cb741208214a1feaa05d7aa8f1b6bb827477c9138fbc0b160aa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706719, "uuid": "26a76245-a075-41d0-acf1-23dcd56760c5", "comment": "Malware payload (Mirai)", "value": "abcab1647f325ed9f2f3f1a1aaf27980ea34eceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706719, "uuid": "ab3a4096-951d-4dd2-9f76-d1afb590591b", "comment": "Malware payload (Mirai)", "value": "bd7e88a56a3973c3cee05fc7e4972a5b3df41804d953a36275e98d8ba2bc58183c94ceaa0edb15c8211b61e50ed51bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706719, "uuid": "64b1cbab-d944-4738-a68f-8e738880eb9a", "value": "T1C9831985B881DA23C6D8227BFA5E42DC332653B8D2EF7203D9159F157B8682B0E3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706719, "uuid": "949ae073-7fc6-49fe-9be8-ea2bffdc5568", "value": "1536:ytMuKfo2EHV58aLsIpTYZ9Xfzr9UsIAho+8n7Xit346BHK1T2bVR:2MZQ+TUsIAho2tI6Bq1T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706719, "uuid": "9d9c0156-5fb9-4392-9537-a4bd5088009a", "value": 81604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706719, "uuid": "3560c426-2473-42d4-b752-bb34eb7edd67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706719, "uuid": "047dc519-e9f0-454e-9056-c83dd25a5d83", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb89558-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626071, "uuid": "fff857f5-2416-4eb1-838a-77b5d036be6a", "comment": "Malware payload (Mirai)", "value": "6083b11c7d474912bd7b5517ff866dd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626071, "uuid": "5fc2d29f-c7ce-456d-918f-1cbc79c4b453", "comment": "Malware payload (Mirai)", "value": "1ffed5905bebafa8b156bc915d14868735b8e17d1cf1d1e21fcac31afc1d06f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626071, "uuid": "b0f0bc49-4d04-47f9-915c-525e9d917e83", "comment": "Malware payload (Mirai)", "value": "50879bb27d39d57dc800669829e81b7df53f18ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626071, "uuid": "851f7b48-ca19-44ed-aa79-1e23c49f7563", "comment": "Malware payload (Mirai)", "value": "7d2a39ac431817603be0614323d4ac6b6a4e7b8861a726388f17335860d9915aad13595d23b9b2234dda6aa659c45d44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626071, "uuid": "a5ff82c6-7343-4373-b6c4-09423db9073e", "value": "T121A2D13CB70148D6E81ED17992DA03D73F680762E0437C4D6ACAE79BDD448E0A8E3AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626071, "uuid": "49f93760-b6eb-4a08-9493-d2ea92ffd4ce", "value": "384:GZdlERkATD4lzi1RcraEEZ1EEiepC5YfiAD+wp0iX9ENtQo8dSJgGlzDpH7uNj13:GZbERtopi1RUaEmoeFs2XdSJgGlzDpbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626071, "uuid": "7be0f253-ac66-4092-a6ad-62e3aad1f744", "value": 23192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626071, "uuid": "66758a01-e227-4dee-9918-83df5b623547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626071, "uuid": "434ba607-2665-41c8-91e1-8dfd515e8a51", "value": "0.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5959c1-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1766666230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666230, "uuid": "f4dc4f2b-e8b5-4df7-b46e-db41f9402e58", "comment": "Malware payload (SVCStealer)", "value": "3904bde96ca576cf5824fcf237235fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666230, "uuid": "ddf3a245-08d2-4df6-be77-31b626139000", "comment": "Malware payload (SVCStealer)", "value": "21665d2e3eba75d5046b86ed6196b84272d7a8020ecf4fcd8f4e85fb1a76344a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666230, "uuid": "784593f4-582b-4aef-ac57-96b534ccd9b3", "comment": "Malware payload (SVCStealer)", "value": "369224277ecacf96fcda6fcd69f90e84fe98f209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666230, "uuid": "fc78c846-4567-4564-b09f-345f3feaf600", "comment": "Malware payload (SVCStealer)", "value": "f91298931ad223fa08cb4c7fcac9fe8ccf8e8c629e3b31a16d967c6737b6e489a2f88d22d9f4cf4dc066a8c76f6f74a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666230, "uuid": "0d1d5483-2226-43f2-b637-2db9fadb13a1", "value": "T15F463394A3E00EE6FAA7903DD8B0D815D733B4260711E45782F447366F277F1AA29FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666230, "uuid": "c5ba551d-73a0-465a-a0ff-33d16cee22ee", "value": "456e8615ad4320c9f54e50319a19df9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666230, "uuid": "37efc287-2a13-4556-9c46-f4579fc02757", "value": "98304:Vlj7lEWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAxSSpXq0e883q7DlAwdx:VXHiouWJysVYvsOaoyMxxvjDDAxSSEoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666230, "uuid": "9158c8fb-a226-4de1-8959-a4fb5f0ed8be", "value": 5841232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666230, "uuid": "1dec4df4-e9f4-4c18-89f5-dea548dade65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666230, "uuid": "f20229fc-8f63-4748-94b6-d15e932ab071", "value": "3904bde96ca576cf5824fcf237235fac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee68826-e18a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766664647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664647, "uuid": "fe0198f9-6569-4f4c-9805-ab6dfb547d05", "comment": "Malware payload (Mirai)", "value": "92ad94af2ee5fb150f0d60097c65a8a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664647, "uuid": "a122312a-a8e9-4d4b-97b2-5d5c1cf958b4", "comment": "Malware payload (Mirai)", "value": "219668a03eea0a112aa1fe0570b950af7cb47b746c8157327feb7cc5f7552026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664647, "uuid": "441cbedf-d291-46d4-b860-d959735c0689", "comment": "Malware payload (Mirai)", "value": "d4b167f8b3403099b2f00e5118250f1dce8136a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664647, "uuid": "df470064-b6d8-416d-b757-0a30f688b494", "comment": "Malware payload (Mirai)", "value": "6c78c7a5d47a1a61f9573a10db290d5a4ee3045c44b6d80f3ee564aedb1c2d65facf3a5c8bc607613d34a61b87f52fca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664647, "uuid": "06217a1f-9cd2-4339-a391-f820f05aede1", "value": "T1D0932A56BC818A22C9D513BAFA2E118E3313577CE2DE7312CD105F20778A96F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664647, "uuid": "0d17df16-8086-4dfb-b16a-2794598cf51c", "value": "1536:mpnyQMpEZz4WK9bPTgv29vsIczKXcomGk5gzvOaoDKGROdZRiH3dDijYv:dQMa4WCjTKY3czKRBkiDOaoJ3dDij8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664647, "uuid": "446ffcb3-8a12-4cfd-968c-04a89b689edb", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664647, "uuid": "e803a89a-6a24-42b5-b577-72c32bc8b787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664647, "uuid": "c325a57a-742b-4524-8a47-f4c80d62d6da", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1dfb179-e166-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766649270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649270, "uuid": "4f9b4c10-f249-4d03-b712-59c45c241f4e", "comment": "Malware payload (Mirai)", "value": "081b5e0cca713c826c57d3b68e4a69e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649270, "uuid": "50efe488-90be-49a1-aaa5-e97daed44dfc", "comment": "Malware payload (Mirai)", "value": "24985f557fdc3839d349cab74690c98f26a93d1f9adb74cacac415104f6580e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649270, "uuid": "024398e6-9688-4cf0-a173-bcd943ead80b", "comment": "Malware payload (Mirai)", "value": "4b7e8db3521e92da88a27a567d7288cb7c1cec03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649270, "uuid": "ac22b8ee-2903-4b52-a837-3bfdda76d8ea", "comment": "Malware payload (Mirai)", "value": "727f73f86f77bb584d0b8df3180ef5ccb572f4b30d4d4ec4d60485533083212193393c9fa7a0c598db2c624da57cfac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649270, "uuid": "40e23d24-d739-4ac5-a06e-2daf13626375", "value": "T11B14074AB9919F11D5D231FEFA9F419833136BA8D7FA7101DD206F6033C699B0B7A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649270, "uuid": "fb8361e4-8369-4efe-a429-e7779f85adbc", "value": "6144:0d425iSP/c88zc/vCcSaU/MvNL1QH0hP14iWXjX6i:0d4To/Nqc/vCZaUcNL1QHGeiWXjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649270, "uuid": "0e784f08-2c86-453f-ab9e-a7ac7946967f", "value": 201416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649270, "uuid": "ed5d5be2-92ad-4df4-9724-583388c77d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649270, "uuid": "957d3766-c788-4f16-92b9-6cb1c708b711", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f833cf-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666484, "uuid": "aba8c908-e3f6-4f1d-b75d-5e19eae00cf2", "comment": "Malware payload", "value": "65865d6f844d8ccd8aaea99e135904ea", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666484, "uuid": "b6eb784c-b536-4d35-a79b-7b4187bccae3", "comment": "Malware payload", "value": "249bc00ea0798f78768dfd233be2f1eef51dc2e8c86677bb87f6cef59eb14cc9", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666484, "uuid": "1f6d9519-4f39-4630-87f4-edf3fe5694ec", "comment": "Malware payload", "value": "ba4f3d44425d75df006a910244a349132fb92fe9", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666484, "uuid": "f67373f3-1c89-4bfb-bd2f-72731200eba6", "comment": "Malware payload", "value": "11794891f9e1392cc481f5bc42ae366373605f2ca6317eb0e6db6f60aac6c8c4e779cfcdf128fa6704bee926da3a4d8f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666484, "uuid": "7209eaf5-9f56-4fda-a5fd-43c7df01fd7f", "value": "T1F0D52F8DF69C8566D60CF6353D5A42A4DA2E9D087818D747F10E322D7FF2A30BAC568C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666484, "uuid": "b41aa8a5-9c66-46e0-8177-ac524b23853f", "value": "24576:Fzxy9O6GnkWM/exiQm4wNP11c34rSz5Yxj3l7NXJ9LWR9Ktp76q:ziZGnkWMl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666484, "uuid": "f336c257-90d3-408c-9b20-c9668dac6910", "value": 2895872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666484, "uuid": "a100d3fb-4fc2-4420-9177-1833f1106ce3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666484, "uuid": "0b4c370a-9fa6-4923-bdc7-0b9050f62f22", "value": "Newhouse Preliminary SOL-12-15-2025 A.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93751076-e15c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766644817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644817, "uuid": "413fc3d1-2ee4-4623-a0a3-9f1338c1cee3", "comment": "Malware payload (Mirai)", "value": "83e493586bad8d37fed35bff75f4436a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644817, "uuid": "3046938f-010b-4a4d-a344-744f9abb9f14", "comment": "Malware payload (Mirai)", "value": "2585d32624bc85a69716d9b05a1fe54465ef3f76c4b1dac506df832ef8c7806b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644817, "uuid": "a1964cad-e164-4ff1-bf67-41d01b805746", "comment": "Malware payload (Mirai)", "value": "98b07887db938445c1bcd738518484c312362445", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644817, "uuid": "df02242a-aba4-4188-9178-b0a3a83eb973", "comment": "Malware payload (Mirai)", "value": "926feb66ccad3b23ef4c024b82cff194e122e84a5510ead8bdf783cd28220779a354490c27891ad4a4d1d5ae1dd04305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644817, "uuid": "2cd20cb1-4247-42e2-98f7-494debb9e618", "value": "T172B3B71D6E218F7CFBACC73447B78F21925937D626E1CA85E19CD6001E6034E646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644817, "uuid": "07c7dbdc-c558-4ca8-a8a2-498bb4c812bf", "value": "1536:nVeMxyS1y1yxX9Lt1xXg1fqHFckRIhAd9oJ/AdRrfPUPGqFJZe4Tg6wwu:VRyENt1Ng1fqHi4dW+dRrfPW5Lpc6wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766644817, "uuid": "f52ee691-5f79-4469-b8ca-ec17d26714a8", "value": 113572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766644817, "uuid": "a1bba86c-fc1d-4338-938f-59d2673c2992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644817, "uuid": "f9b63252-3af6-407a-b43a-d7e5db85f0c3", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9d7668-e15b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766644539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644539, "uuid": "952353de-d8da-4c61-9d49-2807110649bb", "comment": "Malware payload (Mirai)", "value": "47d398177669bb11671356761a1d2f99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644539, "uuid": "e4150073-d683-47e9-8c2a-570680018b89", "comment": "Malware payload (Mirai)", "value": "26aeb33a90346d84de22e65a6bbc49b697311f5dcc9cdfdedbe66c0aadf0ba30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644539, "uuid": "714fcbe9-9dd0-4b81-86d3-ee12b0b0b444", "comment": "Malware payload (Mirai)", "value": "79da549a55eb0508563514a40a68c56f0f4d86a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644539, "uuid": "446b5314-4029-4a6b-8b58-4b4cf2b0d4c4", "comment": "Malware payload (Mirai)", "value": "ac370307b33e4f992e61591ad4cbbdb6fe60535d0e6d03c2cb937aae4f8be68a6dd22d3e133bc9b049e127c395c4eb9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644539, "uuid": "56933184-965a-40d4-ad6d-3ecc1ed902e0", "value": "T13B242B037A81C9FEC496D1F04BEBA5319979F82D0635714B3794FFB12B09EA02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644539, "uuid": "8cff9440-edc0-4a74-9432-cf23bd3d720c", "value": "6144:KBbbTJgbFZQhT6BdrPG2er/+PlNLL/4X9:KguT6Bd62er/i/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766644539, "uuid": "d7f551de-4642-442e-b350-1c17fe4079ce", "value": 213456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766644539, "uuid": "36b5f1a6-891b-4f27-80dc-a65e18c21c98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644539, "uuid": "066dbcce-d812-4744-b774-494747e274a6", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad18529-e163-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766647594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647594, "uuid": "074218ed-8294-4586-ae16-b6c62dbff2b0", "comment": "Malware payload (Mirai)", "value": "a1662307e3e4a669747511e5e03f950c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647594, "uuid": "bafd9a2d-b1e5-497a-a664-6cf4b0ab51c7", "comment": "Malware payload (Mirai)", "value": "279fb7682a027c1cf63207c35c772f8f32afc4ca3defa9231eed1adcad12be39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647594, "uuid": "dd1de011-0d05-4420-808b-d2fa0070f04c", "comment": "Malware payload (Mirai)", "value": "83a6c9ea9cb18a7f7d7b93272de2748c864a5a3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647594, "uuid": "ca570a05-e86e-4d36-8bf6-05e6fa8be2b8", "comment": "Malware payload (Mirai)", "value": "6300061131e46c82bd8d01e2513ca19fdfd4d617f03486c3e91d5c632637e845f24971e4439f0306ba2557cc46cc0cf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647594, "uuid": "3a48bbb2-9396-4ea1-8245-254ebf91150d", "value": "T136835B22B9791E2BC5D0A87B21F78375F2F1478E25A8CA5E3D710E4EFF2464022476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647594, "uuid": "e709bb8c-56cf-4368-86c4-d2753a7d32c1", "value": "1536:gagyPnuknSUioNTQH56Gr1t1eGemtiqaYl50ZItzc:ggYCcRP1eOwlYXGkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647594, "uuid": "5cb3bde7-719f-4e40-b2f3-d7ca82edfb21", "value": 87560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647594, "uuid": "d9ab799b-c342-4931-b304-fd426ef8140e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647594, "uuid": "df493118-be43-4293-bf69-32fded067b7a", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a1fc27-e188-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766663779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663779, "uuid": "01f69e93-7dbf-4243-872a-26dba2f4d20b", "comment": "Malware payload", "value": "7768618b89e18d5ec0b2a2335dbb3f5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663779, "uuid": "d0bdfeea-b3bd-4ebe-9801-88cc2e81159f", "comment": "Malware payload", "value": "286df0ff67c7d2bb59de15c42055730312c5079bc99b610e0ad919d7e5b0eb38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663779, "uuid": "84361d2a-6864-4a69-9604-2614d25f02f4", "comment": "Malware payload", "value": "54391d9eeafa127774a4c5bae3f4342d7e96b7dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663779, "uuid": "cddf647e-e4dd-416a-ae1e-525dc5094654", "comment": "Malware payload", "value": "f37bd1e3fd3e8b7fd4f31b53462e0bced768753e6095b1010138a76d66f666285f5ce6cc26b1e057de88817b56ee4ff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663779, "uuid": "96ae111d-f3b3-4613-b620-1786aa645499", "value": "T190177C43F8A146B9C1D9923089678116BBB1BC498B7563C72B60F7383F73BD46A7A350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663779, "uuid": "0f44182b-bea2-4c47-835c-a2191f81bec1", "value": "196608:0+nUlo9xSrqlOEH+oDZcWTVKDhkGPgLzP5LLJTHZ:0+Ao9QOl3H+oiSVigL9Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766663779, "uuid": "f678e837-fa1e-4119-8cc8-9b5b08b86018", "value": 19345930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766663779, "uuid": "5fe46d1b-9a7f-48ff-83bf-69a362ea2e67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663779, "uuid": "b1adfed2-fd27-4633-9bf1-66f5c98c179d", "value": "merlinCLI-Linux-x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a86bfc8-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666492, "uuid": "5fc4f6ec-b20c-4871-b529-3f272345313c", "comment": "Malware payload", "value": "a78f018814b6024e31be8f343afcb322", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666492, "uuid": "d84ec8fc-360a-4e41-81f8-03e186b723b5", "comment": "Malware payload", "value": "2877c69b79d6087d714c6e31f0365e935400c25968aa085e3a55a8ed6d766987", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666492, "uuid": "588667aa-5330-4e55-8e05-7cc079e21959", "comment": "Malware payload", "value": "0e638fc2c18b1fba8bce90157629d5c85c861bce", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666492, "uuid": "fb899f84-b657-4a07-b44e-ef0fe0d0be01", "comment": "Malware payload", "value": "0233834a03178d3dd5a016277ba494e3f6581ddd7bb4ff59b0e87fc7eb9105bb9b330a50f89d31c3c76f80df1667198d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666492, "uuid": "26015264-06d3-4219-8381-1ce7f74ccd57", "value": "T18D15E1BD7981C8E4EF3524BE8912E4BBDB64AA20C5A32C3B55501E4535FB0F2B3D1A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666492, "uuid": "88766cdc-f747-492a-911a-d1c5c4297aab", "value": "24576:ajmiPYdrtbx7bZNVvbDcE0Vs3jV8MpqJTUGQGX+:aD8b/oElCMpqFTQGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666492, "uuid": "b699e2ea-592c-4af0-8e86-4e6f0b884bbf", "value": 887037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666492, "uuid": "bc9b09ff-dda7-4c48-a0f6-8a02c89617e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666492, "uuid": "8fa61364-59f9-4286-a14c-189dde10b455", "value": "GSTR 9C_Offline_Utility.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6daa44-e15e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766645634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645634, "uuid": "da4a18e6-c2d3-483a-bfc3-024d341b044c", "comment": "Malware payload (Mirai)", "value": "c238b9c877c9ddb14937165c118d1512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645634, "uuid": "99648de5-b418-435e-8237-aec713bf0a3c", "comment": "Malware payload (Mirai)", "value": "28d2e77b2bdc3c4d0b9157588d5b1f196b596107a61e352a504fe8bb4e15f4c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645634, "uuid": "8b337308-8a14-4164-8d66-298691ecb99a", "comment": "Malware payload (Mirai)", "value": "4b7edb4342786b6d1e890d3e00f8ed4d6e0f241e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645634, "uuid": "4075ca47-732c-41bf-bd7e-21250fd27e8f", "comment": "Malware payload (Mirai)", "value": "30203f7ae6930adf0228b9e9183f9b0af36a5133cabc79ee01287474c4360e4909347bd9b479a5d6d1d898acf278e5e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645634, "uuid": "e0e38bff-6249-4477-8f3e-469f249cee4b", "value": "T1AE930841FC829653CAD423B6FA6E41CE332663A8D2EE3217CD216F11378A95F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645634, "uuid": "e4a770d3-737a-405d-bcd3-929d61647a0a", "value": "1536:PO5oC/6pfM9VOzmy8Y9hWHc+bmWHlToCpr0udZZdaL58AFy8vw:PO5rafM9VOeY9E/hZds8Qvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645634, "uuid": "1c62a68a-bde5-4664-a595-7f437851dd7a", "value": 91448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645634, "uuid": "9327a9cf-0732-40f8-afe9-e2600291c574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645634, "uuid": "206d2293-90c2-4946-a988-551e0b978035", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e18d19e-e188-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766663518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663518, "uuid": "5ec8db54-eee3-4600-b302-40c065db8df3", "comment": "Malware payload (Mirai)", "value": "d5d86277af7790a224ce618f7e925dcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663518, "uuid": "a2bcc919-56cf-4489-ada9-6c91b41fc4c9", "comment": "Malware payload (Mirai)", "value": "28daa4b3eaf78c6ab3c0f8ae0151111f5a064c127e2353efcc6880733890eee4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663518, "uuid": "09e2198f-1b31-4b10-8437-5688ac9d2520", "comment": "Malware payload (Mirai)", "value": "42c10297c75711beb389b9272485c507240ba95a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663518, "uuid": "e123b65b-55d3-4d70-b8fb-b7a958a39447", "comment": "Malware payload (Mirai)", "value": "1b496bb6dc132902a9e69eff45e25bb79f781a1ff9cb4bb1eecd9309decec448a5fb02d7a0e21b5e94b9ef1d4d1c427c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663518, "uuid": "b8576747-b1f5-4d47-bd83-0d154fe4bfd8", "value": "T15E839D33C83AAD94D54986B4B9A19F381793E90081131FFB9AD5C7AA4087EECF5093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663518, "uuid": "6b25a3eb-2fe3-48eb-bee8-9a060dd8a257", "value": "1536:p/0nLSEaHiNoDwti8FHa8zFb8TYsv6FmiKHA9MMUkBC5DC:pcLfTkd8pzlmFHQUkBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766663518, "uuid": "74014b44-df11-4883-96e8-ab93094a7592", "value": 84696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766663518, "uuid": "b5dd9746-c69b-4165-a6c3-ec3e3eb9c671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663518, "uuid": "5e3524d8-1dc1-4931-a720-7d81154203e7", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed48402-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766690336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690336, "uuid": "3be63a72-ae23-46be-9ed8-05258b118338", "comment": "Malware payload", "value": "6f49869579ebfbfd0560a597139ae7de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690336, "uuid": "c8432bd4-7b53-4675-8f6b-6b37d8cc2489", "comment": "Malware payload", "value": "2941758da55ee6c9296a70d05e14439a2c8a8fd9ab6865de38ca9fbec5496e49", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690336, "uuid": "883a368d-e87b-47dc-865d-fcecfacc79f3", "comment": "Malware payload", "value": "c2c47fc5745c427c1a59b0c858aefc34d3049832", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690336, "uuid": "cfaedeac-aa8b-4240-91ce-512aed152fdc", "comment": "Malware payload", "value": "79b8fe737e811123a7aa3587bc62c27733f2c310305b1d4c5f26bc5f58eb302112280f97b7b4d24bd2e819c42eebc727", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690336, "uuid": "a06fbd56-0be9-466c-9794-ab885a2a6250", "value": "T10A11B6BD141110398D02CDFD912B84A865E7F3CA2E21DE256D9438F8C8EE92C2D7553D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690336, "uuid": "b17345ed-ea86-4982-b373-23d5eea645b9", "value": "12:ovzs6Is+7bkX+dG+e+R5ZK+1LKQ0+8OOD+Nin2W+bI+gSv4+Nt2Ws+bK+0Pd+Jv:B5GyJKQAki2lQANtPGPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690336, "uuid": "71862f06-c5d8-4aa0-bb86-7b9df2976140", "value": 945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690336, "uuid": "a99656c1-0655-4dca-85bd-371a57318e16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690336, "uuid": "288c70e4-b481-4b2f-8e38-7537545b0b18", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b273796-e15e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766645635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645635, "uuid": "09231503-949e-4ff1-b9e2-c97300256b65", "comment": "Malware payload", "value": "9077cabd410862cb11d898475d7a81d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645635, "uuid": "6c0f87d2-5d98-4240-9911-28ecc9838fc6", "comment": "Malware payload", "value": "295112f01dda5b56ab10ef899211b2aba617bffdb3805050cc057f83fcba34fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645635, "uuid": "c035aa33-5bc8-46e1-a9dd-0be52996982a", "comment": "Malware payload", "value": "0086e6609cabb3fdf31bcac03ab10a1b3ed37a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645635, "uuid": "a1e77421-9f98-41ab-86c7-402a85103418", "comment": "Malware payload", "value": "955e03f3bdd0b6ae3c0e822d2132d428b728e1c80920c1a780bdc04c6d7b3f4d971d17b9082ba1b010a7aa33f4f13035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645635, "uuid": "b50f33f3-2eed-470d-ba6c-8cd3f3493b74", "value": "T1A9C35C4AB70D0A43E39709F02A3B27D6C3E96AD170E5E648250AFF089275E779146FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645635, "uuid": "48f703f5-7073-4efe-82b2-d9df6319181c", "value": "1536:hVAt2zENoXjQKw5KZkkDlcrPd3UrkBoBSO2dE8lmUEqrY9r3K9MAAyr1i+3dlaP2:IEzBfyrPWQbdE8JerKWyrpuP6rpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645635, "uuid": "17a3589b-6a2d-40d8-9123-e1526d8f4dff", "value": 121652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645635, "uuid": "17f04816-a67a-40fb-8289-15ef2f96f158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645635, "uuid": "86943892-243b-4ed8-98cd-571da619cfae", "value": "rondo.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b79c48-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700899, "uuid": "a3d0a727-c47f-47a1-912a-4349d1440434", "comment": "Malware payload (Mirai)", "value": "478c8243efea8f6199057e6b2d3c5d26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700899, "uuid": "8b6b85cb-cc2e-4f32-ba70-a0e5a7437afa", "comment": "Malware payload (Mirai)", "value": "29f74cb1c262c7f0af1949357e7c338955b319f2627582f876256554db25b0db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700899, "uuid": "def05126-ef19-4fec-a6cb-b4041282eb71", "comment": "Malware payload (Mirai)", "value": "c4dcec453fbb822a8a608678c7d845db76ca2e4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700899, "uuid": "c9836cbf-ca07-4f20-b7eb-d57b9840d6a5", "comment": "Malware payload (Mirai)", "value": "4375a8f7ec0e043f3cdd8a7149e90c80577743c8469181232b729d2a55caabca85be0ea7e6706973d8230d967a1973df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700899, "uuid": "f8cf47df-2765-43cd-ba90-c9bf2f1b558e", "value": "T1B6D36D8AB002CE3DF94BD5BE54770F09F931A3A122931B2E529BFD536C321A55D16EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700899, "uuid": "368496c9-8ed0-4013-983b-622729953bd3", "value": "3072:D5oIiEuJUJFLGMBZ6GiXvUT56pW2U9/Ch2MWM/l:66uUJFLJQ896pW59VxM/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700899, "uuid": "ff5bf800-7181-4897-8cdd-2d601821d9ca", "value": 132524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700899, "uuid": "d79d3ac7-b65a-4477-93a3-2702acc0ce62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700899, "uuid": "88223969-e77b-493b-968a-1f1141c784cf", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db50b37b-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766673284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673284, "uuid": "c29ae432-d1fd-45fa-97d2-4d1e91eb53e2", "comment": "Malware payload (RemcosRAT)", "value": "56d61c68ecb998dacaa3da6e3dd3611d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673284, "uuid": "124c77c4-e468-4a91-a97d-51fba079ef0f", "comment": "Malware payload (RemcosRAT)", "value": "2ab53c46843e0719823a65cdfd414e3fa202691165f2e75951d51d884d01bdd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673284, "uuid": "2667899b-e93c-473f-9dbe-bb1b265459b4", "comment": "Malware payload (RemcosRAT)", "value": "b0fb2c2d4c986117dd33ef6b7e493cc7e3fe6774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673284, "uuid": "9d74d083-c999-4698-9bad-12710ff6f75b", "comment": "Malware payload (RemcosRAT)", "value": "a4a21160d2a7e593af225a8a719c66d205debd6b55d29fdcb1ed9e937d5c97abe11574dd27f682319b4fe395d2322d4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673284, "uuid": "6325ec61-6628-4fb1-bd5a-e7d864935b6e", "value": "T18A75F12276E1487FC2230EB54C67D6D81D2F79303A28A94A37ED1D4C5F79A513A26EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673284, "uuid": "2fd933d7-d033-48a1-b403-463434cd82c2", "value": "203e92aabbbe6012ec08d2fb50e38874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673284, "uuid": "90461839-0751-4924-84dc-67b6d6fc8a88", "value": "24576:GewqgN+/yQDPo3qkVttEJOuljiNRKZ+9YSkOO4Li1vDxILF3ojCxgAbJuNYd1VZB:G9UU3dsjiHKZYLixD+IGzbJuNYzbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673284, "uuid": "a4d9208f-0930-45fe-8021-3a1071212f11", "value": 1691136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673284, "uuid": "c3bc99d5-80c3-4ef3-9bb7-d105e90569f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673284, "uuid": "aa30f4c6-fe04-46aa-87ff-60657f65eadf", "value": "Sip 02040_263160078_Teksav A.S_Y\u00dcKLEME_25.12.2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2072cc-e168-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766649850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649850, "uuid": "fdf6f014-cf1a-4774-91d6-1bd834a7083f", "comment": "Malware payload (Gafgyt)", "value": "e5f972e73f3c016bffb7a0b86e05bffa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649850, "uuid": "0a58aca9-434e-45e7-8d37-773ed311878b", "comment": "Malware payload (Gafgyt)", "value": "2bb94741a7895cda8fc140564b8ab55cd27e52fd424f85d272c301765e7bf4f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649850, "uuid": "acd46a2a-00f0-416e-90b7-52774062365d", "comment": "Malware payload (Gafgyt)", "value": "6c8a81f23515513284875696cea2fae4b6493ee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649850, "uuid": "ce8f97d6-b898-4dca-9bd5-384b3cb68bb7", "comment": "Malware payload (Gafgyt)", "value": "3d90542bc52828ca6da05bca628f6da7f939c611601215646114a60f7b7f5ce3862a4cb5f67e61167ac1182c4ffd9846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649850, "uuid": "95614246-dcac-45a2-b9f4-f75dea820e21", "value": "T1D4F3846A3711AB7DD26CC2320BFB6B70E35521D236E1CB55E1ACD7181EA038D9C4EB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649850, "uuid": "3646a70f-e0bf-4f3e-b14a-f90522347e9c", "value": "3072:3qd1+SZkc0S6GQMhSsz9l5hRJ60LmK13itKbJ:E4SZkhS6GXL9l5hR5LmK136KbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649850, "uuid": "5b464ff1-bbc6-42ef-96a0-fbaf7f278169", "value": 167173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649850, "uuid": "2ace8a8d-6019-429c-9e1d-b35c3ac8ed2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649850, "uuid": "fb3db1a5-6a24-426d-9013-75ecc480584a", "value": "i.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdab84d-e158-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766643200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643200, "uuid": "45172ebd-818a-4e26-9229-25f6d1d0eef5", "comment": "Malware payload (Mirai)", "value": "7c7d9fb1d2c6d383bb9c5b9a7e968cd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643200, "uuid": "1228465c-8efd-492b-a9c1-2005eeb59c1c", "comment": "Malware payload (Mirai)", "value": "2c06748830c47589ac5a297bb46bb4c53e58c549f763b873e8df691cba2be356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643200, "uuid": "cd2ffb6b-eb2f-435c-901e-1b37f0d58f8b", "comment": "Malware payload (Mirai)", "value": "4bb9df9b670fc4acfcf80d784cdf721a3bf78d9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643200, "uuid": "03ed2b98-e646-415d-83e6-258f9d1550df", "comment": "Malware payload (Mirai)", "value": "08f05a1a2868f9495c4b206b90a4ce4a21d264a3ee1b203d0fb559d918034deb61fe72c38d5e0f5b506a0e0bc97007f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643200, "uuid": "044e9684-ccd6-47b5-88c3-887c2bcfed5c", "value": "T181B3C419BF650FF7EC6FCC374AE9170525CC692A21A87B357934D918F64A24B0AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643200, "uuid": "38f4d996-c57d-4ba9-a609-b038d7704e15", "value": "1536:nbdwap15gP+IDbEaDH8mk/PNd75z4TVSBgr/kLGHIbSm+ZmR9/b+mOc+f:bdwap15CEaDr0PNh2WIIbF+ukhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766643200, "uuid": "d0c8da62-7d0a-44ad-b63d-981f224c0c3a", "value": 113572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766643200, "uuid": "e2b5ce71-b023-4f86-a9a4-6e6036039234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643200, "uuid": "a8c784bf-b282-43d3-97f4-dc4bf795d516", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9556e7-e19c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766672454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672454, "uuid": "974194ee-45cd-43ec-bd9d-9bdb3c7989ba", "comment": "Malware payload (Formbook)", "value": "3491ff628e4439a7953718665e5f01ae", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672454, "uuid": "3e040532-3f50-4838-84b7-ffb17268c078", "comment": "Malware payload (Formbook)", "value": "2d69b310e05770207e0dfbc31f64586a5edefe9fa24ec1c66bada9d50a2f5d05", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672454, "uuid": "ecf5302c-9444-48be-891b-d6d6b54cf3d8", "comment": "Malware payload (Formbook)", "value": "383376c39400c7d69223f78286098d698c4bd291", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672454, "uuid": "983f320e-f3e3-4bfb-85e4-871fa497b945", "comment": "Malware payload (Formbook)", "value": "7b572b0b8aca2b45bb30e41787daac168eda4cda912026f50e0e8d6a884e410340a686ad56e9a18fcc3671035d8a8aaf", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672454, "uuid": "f1682608-ffc8-4638-979e-fa8958821b43", "value": "T11B16C420D2BDC609E67059511EF2C9DFDAF1823F8F56A1473EB8D395EB2043A543AE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672454, "uuid": "94b80552-692e-4045-b3c4-0f73b9289b6b", "value": "3072:sPQ4PydPnxQOPy3PIPQOPy/PI/Q4Py/Pv/QgPRbP3PPHP1PP2xQOPyVPu/QaPR3p:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672454, "uuid": "b533468d-89f1-4a05-a021-24b6d8e6140a", "value": 4203413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672454, "uuid": "1ed01a32-be1f-4593-a84f-317f8787cf0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672454, "uuid": "954d0153-f857-4f69-94dc-b1e77ffa4f0a", "value": "(BBVA)_Mensaje SWIFT-PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e4766a-e191-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766667538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667538, "uuid": "960581aa-32de-4714-a603-e30a193bbe84", "comment": "Malware payload (Mirai)", "value": "3d979720fcd3c4f7ccabe3f19b95010b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667538, "uuid": "0d3bc4f8-a277-4980-bd4c-aeb18c38164f", "comment": "Malware payload (Mirai)", "value": "2e1a384562bb78dbde8e6ca5aab5f59e4cd462b8d75d0644af3cd5d6c7de98cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667538, "uuid": "051ee931-a815-4a2b-bd0a-efabfafa8d09", "comment": "Malware payload (Mirai)", "value": "7d7b9c16e1699a173c2a70c6b54d0390627405f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667538, "uuid": "7a9f114b-9df0-43e7-9ef3-4b1d198bf46e", "comment": "Malware payload (Mirai)", "value": "8d600039db9439f4180105567632125ee88f808512eecb965fd3c5ae8fdc0e990f82e63e8c8c944e792247a6c19ad4cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667538, "uuid": "cbff2de4-d3c4-42e2-b293-3c5842991f40", "value": "T1A0833A02771C0E47D1A25AF42A3F27E1D3FEAAE021F4BA88250ED74651B5E361586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667538, "uuid": "d4e33555-a3eb-4d22-902a-24fac40a2520", "value": "1536:1is0jsfCV9hUKEgM4RDSbJR1V1gsPBD9w0k5xSMk7tjsR:4s0jsqieyJRh1pu5xTkOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766667538, "uuid": "c25b2000-45f0-46d4-92f1-931878e02e31", "value": 83356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766667538, "uuid": "a55874a3-9e12-4aa2-9dcd-0c188b675df4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667538, "uuid": "7e56f792-cbbf-4046-9094-77d78be383d3", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791163dc-e155-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641766, "uuid": "72586f50-4e93-41e2-960c-60b63f95ff5f", "comment": "Malware payload (Mirai)", "value": "bae51a8195f4283c70f923da87391469", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641766, "uuid": "b2e936aa-14cb-471e-877b-e961fec33885", "comment": "Malware payload (Mirai)", "value": "2f4f5784e1e4d5c03f4248dfb9ddd9997380421b5f4a687506dc29b7e4cd89cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641766, "uuid": "95a25367-6aba-4c1d-83d1-51651601d3f1", "comment": "Malware payload (Mirai)", "value": "78d5ed65e15d300570a6a4d9150a9a2f1b42d26e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641766, "uuid": "70b7998c-b3a5-4dc9-9e4c-90b9938fc109", "comment": "Malware payload (Mirai)", "value": "5e80a8e7342f11a527382518b8c49c9871c4b1939041cb83de45603446237620fd770473d47f4c02b4825ba9b07ac3b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641766, "uuid": "fb8d7259-a3ec-4753-a1d1-32f0e39cdddc", "value": "T16274F8113B47EC6FFD6A43B40AF78A7477DC65A22561889AE26EBF4D1F310D10D08AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641766, "uuid": "d2f2776f-3c48-43c1-ad34-ab1353722df7", "value": "3072:C9Q3Rf4V+JKBLCwvanDIryZTl/BDftnpj1PR2bm47Y7+4T/sgqT9AtYPVpGHyGEQ:H4V+JKBLcnDImiSfhe5VpgEex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641766, "uuid": "94748c64-06cb-47f2-bb42-dc981d957ec6", "value": 342256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641766, "uuid": "b261842a-1cb9-4705-9f29-cb93153d9192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641766, "uuid": "43373e2b-0be4-45c2-9f5c-1bd684cab1fd", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7124ec13-e162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766647336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647336, "uuid": "a4e14f33-b7b4-457b-a823-a339499511e0", "comment": "Malware payload", "value": "c14baf41b726e2b76da077425830a8bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647336, "uuid": "8117c837-9809-4b09-99ed-7f6e52834cea", "comment": "Malware payload", "value": "2fbdca96c8cdec44e13b5bea56fb118e9cf6bab78b04667a3aec86ddbf6d8d3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647336, "uuid": "f9bedf9f-553f-458a-9c81-d8859f07f484", "comment": "Malware payload", "value": "79a4bb674832b7406de43c0927db9b88fda2f6c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647336, "uuid": "eabac8db-0b5c-49c9-af20-8cbb5b176509", "comment": "Malware payload", "value": "e48f63e21648f197d2fc2223dd318f81aa3d7d2b860b5e649c0528e1ea2738069dc118a330a6a4b312d15bcfd2c4f415", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647336, "uuid": "54555988-9439-42ff-80a2-62ae08289257", "value": "T1216423D6269169F447A9F48B5798AD0416ECE130CF376D88CEC108CE7523E2BC58D6FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647336, "uuid": "580a63e4-8970-4512-86ad-f05ef3efd7ca", "value": "6144:v7lQRaj30gcNbrlFZxd/YVvFJAc9Yq+UzCUSTqaNf3eFeyhx:j+ajEJnjwVvPZ9YqLbWq625x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647336, "uuid": "a1a87f64-774c-4433-aec7-4152f944c732", "value": 327420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647336, "uuid": "227e09fd-2a50-4b0d-9072-93db31d20748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647336, "uuid": "438018b2-5ce5-4277-b3ab-a78725ed79e2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad9e619-e1c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766691645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691645, "uuid": "06951ee0-61cf-4ebc-a351-0f8bf665d2af", "comment": "Malware payload (Mirai)", "value": "34544e6ca97ed662500e17a438819299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691645, "uuid": "646aa02d-dd23-44fc-bc9e-e17bd6f332e8", "comment": "Malware payload (Mirai)", "value": "30c05c1109b42c354f27fd66cc26c3282c6b0d9a80bbc0bfc4009220e1357ba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691645, "uuid": "748df548-bb1f-4d69-bde6-e32d17ae9366", "comment": "Malware payload (Mirai)", "value": "ad81829dbd3d83e8bfcb8764b81e02b0eefd5b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691645, "uuid": "6ad00280-969b-477c-a337-37e2e4c02a78", "comment": "Malware payload (Mirai)", "value": "6bbd9113eb38472b279a7180e4f354ed52d595a7652f2bb20d5cd61a1cfbd606ebe57d48c179a2693a184a97f9c083dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691645, "uuid": "e36dda03-4473-48a6-9b40-8f30d6992b65", "value": "T1EA832A02771C0E47D1A25BF42A3F27E0D3FEEAA021F4B688250E974655B5E362586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691645, "uuid": "ff3dd1fe-26cf-4340-bb3e-d0b928f588dc", "value": "1536:+f+IxEeh/JEBMua4FbMPDRL1VJzBPWp7rISQjxNMkvjGo:+f+IaPMSO7RLN9k7ijxykio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691645, "uuid": "09247dd6-4498-4163-8ca0-ed5a79d92eca", "value": 83356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691645, "uuid": "c67914f8-6cc0-434f-9dcc-ee6b7b0d7f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691645, "uuid": "def6c4e4-e5f0-4a99-8f58-f0cf34396af1", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf651f3-e1a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766677312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766677312, "uuid": "3a96a0e5-d0d4-48dd-bb0c-9326c8126b15", "comment": "Malware payload (Mirai)", "value": "2e95aebdfe795235ebc2ab9530e41e06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766677312, "uuid": "685c0265-549a-4a7f-bbda-b0fd5788362e", "comment": "Malware payload (Mirai)", "value": "30d110dd12b993a400899b15b796ec9c9869ec4c7d6f0837758c8c028bf6b2e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766677312, "uuid": "9424cf69-a23d-45ae-9243-e3f452f1ec26", "comment": "Malware payload (Mirai)", "value": "1c0e21139a8cd00ababe361f2db755627ca88cb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766677312, "uuid": "61ca7aa9-fc86-458a-93ab-a01000a07fb6", "comment": "Malware payload (Mirai)", "value": "406744f8b4f072d2908d84f632660b37df27118e2c4b0602ebf218a3cbdde6b843f5f9dbfce917637d197065bd400b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766677312, "uuid": "91464c9c-48e1-4742-adf1-7e9cb6c2b6f5", "value": "T1A9A35BD6B401CE7DF84BEB7B8417090AF531A3514A930F3A625BFDA37D320995D22E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766677312, "uuid": "380a15c7-77fb-4d4a-976a-555c943a29d5", "value": "1536:bII3toZ/oJHV2LAOMeBFE16WN4Fw2O/qkg8yx8nIGBhQwMCU2OGm4AH9CIQ:iyHVUAE8NAPO/qkp+wRUhEIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766677312, "uuid": "69371d9e-279a-42f5-822e-bf744340e011", "value": 98756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766677312, "uuid": "09c8fc62-b379-4c35-8aaa-ae4e8efad83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766677312, "uuid": "3efbde2c-c97a-4efa-a118-58c7f688b1bb", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29305693-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766694031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694031, "uuid": "4b222f68-6e7d-4f26-a093-8891407802fe", "comment": "Malware payload", "value": "a229d354bd7d97394b1cdf59c447713b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694031, "uuid": "54ef92c1-0875-431d-a5ef-f8d9c39d87b1", "comment": "Malware payload", "value": "3105c042910516e3c4d121442d8735fb423c16f8e1873059f55bbf2333e2a999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694031, "uuid": "4acb6708-b444-465b-a680-11f737d7c5d1", "comment": "Malware payload", "value": "395fd654760f07cc995299a39f4837e5907475a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694031, "uuid": "a2fb748a-7ec3-4733-a727-d6895dc825cc", "comment": "Malware payload", "value": "79ace113aee5c74ae828a13336a050b43cc4c6d6f41f1c88c479d6c61dfe597aa3415d206bb6f55adb295125ce39c412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694031, "uuid": "51a1371f-d058-427b-b19e-09168cdd4842", "value": "T114531B1AB35364ECC62AD57486EFAB33B671BC634630AF3F02E4E6702E11E601E5E515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694031, "uuid": "fdca0e3f-686c-450a-b5a6-83905b865e16", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694031, "uuid": "c57a6496-bda2-4319-8cff-696b036f4009", "value": "768:0a5oPCAeG58IK4PCVzM5S01Qu0hsewzRxUsUlmPX6puv/1bDeI4t0gOiATWhea:06oSzI9HHKrKcPl06Ev/s0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694031, "uuid": "9bbb6302-5a20-4ed8-a8f0-a41716339943", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694031, "uuid": "f9289f67-3d22-410f-bdc7-c62884bc3836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694031, "uuid": "93cd8ec8-2d73-46c5-9fc7-05acd8982e89", "value": "SecuriteInfo.com.FileRepMalware.76971985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9398888e-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766673164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673164, "uuid": "219f7c1c-052a-45a7-bd61-32c041c0e50c", "comment": "Malware payload (Formbook)", "value": "55ca0cdd38ccc9a21be7120577bb92c3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673164, "uuid": "a654e0b1-be2b-4b6e-ac83-74731e635a3c", "comment": "Malware payload (Formbook)", "value": "3137080d1d6159a1a2ddefa88b416ba226d7b6f98e3e90f32ba728f48ef8c3ea", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673164, "uuid": "a015c174-f303-4ccd-b3fe-9c3b6a8af61f", "comment": "Malware payload (Formbook)", "value": "17ac8887a5132299f4f91e26b6148ceac89cf86a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673164, "uuid": "f58e0b53-fa37-417e-9310-2026a3eef8b5", "comment": "Malware payload (Formbook)", "value": "12668f9c8086a0bac002d56f93587dcd3f4654a4b0778d80842090d6bea8ddce9aa3c906e0e68fde8c74e511787f4577", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673164, "uuid": "f8810e7b-aab8-4055-a707-5956ff80169c", "value": "T14613B8CC3FC7B06493512463192FA09AFA1E4C44768C44A1E76759E4F92C728FB7AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673164, "uuid": "10d526e9-39f3-4dd1-ad7a-25c5b7563b03", "value": "768:4iuG+ux2GP550h74gBbG+na3vVX6rx987KsxzU4W59PcsEwnQ7fxRBL:4iu1Zo0h74gDAR6rx9xsBJW8AQNRBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673164, "uuid": "1c8e3e2d-b911-4d58-b9e7-0b7b3b92e22f", "value": 43005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673164, "uuid": "3410860f-e83b-40d7-ba56-7d04a741416d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673164, "uuid": "38101e39-5477-4a26-82e1-e3542f150e50", "value": "DHL Arrival Shipment Notification 2025 DHLABC30247.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34354fa4-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641221, "uuid": "846577f8-9b4d-4f43-82a6-26edf7200162", "comment": "Malware payload (Mirai)", "value": "48484fe39e7ea75a71c4f26819374d18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641221, "uuid": "162651a8-2558-4ac0-a957-a453f864f8c9", "comment": "Malware payload (Mirai)", "value": "320af2f3ca18f600f77966bc12a244540057ea17b38c9f03d17e1920dec1bf14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641221, "uuid": "a2900159-fe6b-450d-9b6b-43d0f56fe8f2", "comment": "Malware payload (Mirai)", "value": "b1e9a15b7e08df5c67e1b0e6f3bdaabe7286e1f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641221, "uuid": "86e849a1-7771-4bb7-98e8-de967658d3b5", "comment": "Malware payload (Mirai)", "value": "df5a1d32ce7d7401c9ecabd064db0bf57e700a9709df93913fa180da7e453a443008d75b21fd4099b4345fa420636883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641221, "uuid": "d9ae5255-80c9-44d9-8ccd-98727fbfaf44", "value": "T1A373BF33C91BBDD4D45C8A74A9A09E341B93E00186171FF61AD6C66B9043EECF60A7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641221, "uuid": "47950b63-3eb1-440d-8a37-9d0599666e22", "value": "1536:6/Ewp9da1i7OfwtdJFajWa4X5bK5zguK8roL543UCdgl:6s6Dh4SJ/angB8c43Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641221, "uuid": "09e2ac4e-3c73-4ed3-857b-cfcd5762f6bc", "value": 76712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641221, "uuid": "a4362340-01af-4cce-80bb-ebc66a4ae482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641221, "uuid": "5612d11e-7536-4924-b6ae-99f0e7971e8a", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92333b0-e164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766648424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648424, "uuid": "967dab3e-0ff1-480d-b33e-493466c6d54f", "comment": "Malware payload", "value": "f47760557b427b4b95392f42b7c7b40a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648424, "uuid": "c662c5b4-5d42-4977-a86f-fb3ca3f93615", "comment": "Malware payload", "value": "342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648424, "uuid": "af14002e-6c37-41bc-a003-4bd2fa799139", "comment": "Malware payload", "value": "72db1691c5ba9331e7888136589c0a38b5fd5785", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648424, "uuid": "99279aa5-1781-4d34-8766-b7f9976db3d8", "comment": "Malware payload", "value": "38bb556400f2b55acc279f925a008d80396375b34209e6d743207c1e40c32811785b30dfefda9c3070955de54b8b038f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648424, "uuid": "a6dbc6af-81cf-46ce-8416-5fb7bb5b6ea7", "value": "T1B6211DFEDE61653441D449792A268535D40DADF43904CEDCB40B0ABB7F84E14FD09B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648424, "uuid": "2a4741d3-889e-454d-8f8e-a493e0aa8a87", "value": "24:efIdXIGDNIiIptKKIIo43s7gIsRXI+GfIwZI30r4I0pn1VInuTIPedIE:efIdXIG9IptRI8HIEXI+GfIwZI30r4I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766648424, "uuid": "60444280-b8ae-48f2-acbe-b5f00dc87e3d", "value": 1345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766648424, "uuid": "d0839e0d-53dc-4ab0-aa72-d98b21026d9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648424, "uuid": "86df23eb-8920-40b8-bf4a-c5dca2b39973", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4032e94-e193-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766668494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668494, "uuid": "f3b1ef7f-9bdb-45ab-b949-5bdecc4286d2", "comment": "Malware payload (CoinMiner)", "value": "8f633ade35df4f992eb28a2c5bc37cef", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668494, "uuid": "ead714fc-ef9a-46e8-9a0c-ed52a3037173", "comment": "Malware payload (CoinMiner)", "value": "364a7f8e3701a340400d77795512c18f680ee67e178880e1bb1fcda36ddbc12c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668494, "uuid": "6b674b28-a922-456c-8688-4e286c77cad3", "comment": "Malware payload (CoinMiner)", "value": "6b2fe529339896b22328dec8936219e7b8e3252f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668494, "uuid": "9acd66c4-9d6e-4d57-88d3-52c172447d0a", "comment": "Malware payload (CoinMiner)", "value": "2546473e05c17621e6bcbfdb9c95ebb7dbd4c38132b412cce36e1bb62fa7e1856a827e8f5e5c2b6cbdf5ba9d20f6c4a7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668494, "uuid": "89a0ea02-c500-428d-b1a4-8bdbbb06ef48", "value": "T1CF666D07B6A258FCC1AAC870865FD573B931B8985211793B3794AB302F27F605B1DFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668494, "uuid": "471a6e42-e4c4-4b15-8619-ce77a421e6b0", "value": "98304:LS8DtMxKWZzBbmDvDvD0iWOMe2FMXWeXjLnx3mQ/nUmumVdMf+RPE3PE3PEbb2mG:DDGAjrYUBlK4rMVe4bLGLfi776u8jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766668494, "uuid": "77313e1b-dfb5-4739-8829-f00ac21d9b67", "value": 7047392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766668494, "uuid": "13d77f04-9acd-49bc-8bac-5a184704c89d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668494, "uuid": "2c07c154-3f81-4de8-956e-e1f11f319243", "value": "xmrig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03150105-e133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626965, "uuid": "26fd633a-bcb7-4945-a714-d67d1781638b", "comment": "Malware payload (Mirai)", "value": "e36761ab844d48d03ac808f43efa682e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626965, "uuid": "4849fbc5-b4ec-4bbb-bd8e-1bf005ff03f1", "comment": "Malware payload (Mirai)", "value": "36ceb444259ec3026324b86f258a7258c2c3d8e8473906f777b70c31fd1334ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626965, "uuid": "5f731c2a-ccdb-4887-af14-57cf7724d232", "comment": "Malware payload (Mirai)", "value": "c93d80974e30bb54b777ebce2aa6b438eb42b720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626965, "uuid": "ea78d911-de69-4dd5-87b2-1473d3552207", "comment": "Malware payload (Mirai)", "value": "10763e19dfbf61d6fc06d7228e7c542a1af30caeb52f6c9f0cfbb572e1ed56167149daa563d6b9b8da9ce37071a0202f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626965, "uuid": "dcd86172-5be7-4b2f-936c-16b426d6e809", "value": "T1AE930789F8819B21D5D522BEFA1E118D335357ACE3EF7212D9101B2577CA92F0E7BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626965, "uuid": "178e516d-8a09-44e5-9392-4a4b0a1f763a", "value": "1536:SxnmOa78mYyUVi6YGiWpcnMr4Pa502UIter1FgXLhUQdhjueJ3GNlHO9iyZD7ty5:Gm+bWeRter1FgXLhLdhjueCO5ZD7tyCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626965, "uuid": "ecac556d-d35b-4e5e-a00f-355969415249", "value": 95584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626965, "uuid": "aa0596cb-3cac-415f-9c6a-089cad54d5b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626965, "uuid": "0781055c-7a83-4dfe-9604-7d7e32625781", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d16d6c9-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766694037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694037, "uuid": "d592b2e6-e638-4647-9a84-80c14551e36c", "comment": "Malware payload", "value": "2396c6918e49f5a949333ffc69f09b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694037, "uuid": "e1872c4a-31f6-4dfe-ba10-2bb7a5a4c030", "comment": "Malware payload", "value": "36cfcda44c69538d4dcb1cc62d8c5b43601a9082ca7425de4eb9f369c6dec9db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694037, "uuid": "135a100a-e632-4a61-8bea-ca7d270c41bd", "comment": "Malware payload", "value": "52f5a6400d1e3f8fb2dacd996e1348c22eb84486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694037, "uuid": "8d4e3d95-eae7-4124-9b72-4ea4f2fd5f9b", "comment": "Malware payload", "value": "bff12b55223ffbc913b2ff2734d75afa08c01439b9c760016aec99afd289212c05cb522e6677d188391466fc5e068258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694037, "uuid": "bb5a174b-f561-4fb3-8c6f-e462012e1278", "value": "T1AFA43BBE9C60E375F608C0BAD285D3635E2178010636BBA71DE9E7201545973EB1A3FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694037, "uuid": "cef957c8-d454-4abe-b60d-bac990526722", "value": "dc3120d7b4090566a887530f3c294893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694037, "uuid": "408e0156-1c84-4af1-99e9-4575ad770acf", "value": "6144:NmKZP9bhEeCdIR3VgJ/IAPkC1Iy2PJWA/clw+Tz3YlbTl7GW7Fqrsvg+sXaByspr:IKZPBhxVLCV2RcG+/CZ7VZBx+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694037, "uuid": "23a3f89d-6399-49ea-a132-eb4ee77d8938", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694037, "uuid": "8e8caf4d-672c-4ea0-9898-59b93c4b3e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694037, "uuid": "242a66ed-4856-4a0b-973b-94b45627e95b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249a64c2-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700895, "uuid": "769c3f96-95a4-4109-bfbe-95af729d708f", "comment": "Malware payload (Mirai)", "value": "6e703e48b8f39a4d015f0354a87217e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700895, "uuid": "cf01702c-0f43-4d4e-a5fb-166ec94891d3", "comment": "Malware payload (Mirai)", "value": "37a4d3543874dcc756d9853fdbe0445223b705b89269eae08ceddccc148c3237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700895, "uuid": "58f9029c-31a5-43ef-8d48-ebc04e99dc42", "comment": "Malware payload (Mirai)", "value": "50428bc35383149671d7eb5904e9ffc1b2c6fd02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700895, "uuid": "da8ea40e-14a5-4639-9a33-88c2278dae15", "comment": "Malware payload (Mirai)", "value": "ef3651bf94ec3e21d4eda5c5c08702751767a3bb0a4ca476ae83b04e7d5b0aacafcbcf14b106d4d41b231aa4e847fc8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700895, "uuid": "f134d023-c7d8-4850-bf18-4fb33ef61a73", "value": "T14ED31855B8828A22C9D503BEF92D018E332367E8E3DE7216DD111F21778B91F0DB7A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700895, "uuid": "8e78d9aa-2254-4df9-b7bb-95fcfa30c616", "value": "3072:0jg+2tvBAcB1P9mo4amvoauPOkF2C370asz:092dBAcBN9mo45AaIz2oNsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700895, "uuid": "4c29c53a-1ff5-42a9-a927-95f40d2353d2", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700895, "uuid": "deb634cf-6623-455d-8ca9-96e3b77fd0f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700895, "uuid": "93c2aadb-d6d6-4fe3-a8be-64e5fd8c1423", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebd77ea-e1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766702872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702872, "uuid": "85cc68fb-7a35-414f-b63c-5b72dd453940", "comment": "Malware payload (Mirai)", "value": "343c38daa1f63d0eb80ea2140bc7e984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702872, "uuid": "0e715fe8-e70f-4f3c-b597-2691c58c6df9", "comment": "Malware payload (Mirai)", "value": "385f31d42a57896feddb67521f97add6b0078b1304007a047d319543c2726134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702872, "uuid": "2413029b-729c-46f6-952f-ebad4f010775", "comment": "Malware payload (Mirai)", "value": "15a717f6877682cee8c93f1aafaec7fa2f27f2ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702872, "uuid": "5d381fff-2f6c-4bcb-9ac7-04c6cf19953e", "comment": "Malware payload (Mirai)", "value": "19731f3bc245a4f207605e807b1c89d41c8d1cd25b132b32762eec9ccaa589bf4113eec029508d0c93cf0d9cb8d32a90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702872, "uuid": "926d41c6-2fb2-4f26-accd-2ba15986bd13", "value": "T19EA3D71A6E159F7DF76CC23687B78E20A75833D63AF0C645E25CE9005E6034D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702872, "uuid": "2a55af98-848a-47b3-930e-b115f0768381", "value": "3072:Zm3+jhVXpSrnfcMleQ2KqMT5wqzBObT29:Zi+jXswQzT5wmg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766702872, "uuid": "bc80eb3b-083a-45c1-9d11-b61b4ac246a0", "value": 105500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766702872, "uuid": "c9a4d835-41fc-41b8-bf62-2c84ae9a6ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702872, "uuid": "34237430-fb84-4880-80fa-1be79e40137a", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8c1684-e18b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665185, "uuid": "61e651ae-b56e-45c7-ae2e-11bd0e711793", "comment": "Malware payload (Mirai)", "value": "9f363759a3f954c599e541529d8ee93e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665185, "uuid": "e9c4568a-8a15-436c-b494-b3b43d8f6095", "comment": "Malware payload (Mirai)", "value": "395a75ee6adfedc9b861a0e0ed60139aa2400c7ed2a35fa2055f660b7afafcd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665185, "uuid": "2c43807e-20d4-4b9b-b8ce-ec95cfcebf52", "comment": "Malware payload (Mirai)", "value": "851df7fbcc3462efbfc33d5b2d1c74789bfdc1b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665185, "uuid": "865f5e39-7cdc-47e7-8a91-41f74e7142fc", "comment": "Malware payload (Mirai)", "value": "adbf4197bc6cecc3f39aff009053766bf1376cc730cceda8b84385397720d9d429327a7b2dfc1140ddb763c1d8d7bd29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665185, "uuid": "e2e14a77-6566-4523-8c19-614561949337", "value": "T107831A05BC928A13C5D027B6FAAF459D372173A8D3DB3303DD146F742F86A5E1D2A622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665185, "uuid": "4b4794ca-87bd-43f9-924d-2af026cc844a", "value": "1536:RW5XRGcZbA9Y+6v6F1wnyJoSEYWrx2yBGGt5nDEtdSxn/6r00/oDn91D:RWZRGObAC+6xSXQ5PbnDE7Sx/6r0Ln/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665185, "uuid": "8cdb0904-71c0-4bab-8cb7-165b2e70a13f", "value": 84338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665185, "uuid": "428dd9e7-8218-4d53-b83f-63bf9c648eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665185, "uuid": "299aca05-54d4-42fe-9a96-d42a5d75bcd4", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de40c93c-e1dc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766699918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699918, "uuid": "3e2e7127-5717-423b-b979-dd34d8c18194", "comment": "Malware payload", "value": "39b72ef0dcd8e89d1f19f1b94a73f493", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699918, "uuid": "d07add29-2c26-4e45-8a8b-37d0568fb593", "comment": "Malware payload", "value": "3a8136bb039b7176dc057aa652eaccd2d5723150325d2ed28b5cdc33f813ed7e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699918, "uuid": "7b816376-fa3f-41c4-aa2d-755d91518d10", "comment": "Malware payload", "value": "aca880f7263cd8ddd6d76cc691ca419857aae9b0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699918, "uuid": "8043e689-45e8-4bbc-8178-de34ac90a006", "comment": "Malware payload", "value": "16b4ec16bb35b18ce29f91e70c4eec24cfbb612b5b612d31d64fb0c1e2ed92a10653d9f47bd090176542a556b77556cd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699918, "uuid": "7deae3a6-f450-40ca-9c84-480bfcbd2a31", "value": "T118D633E3E5D2218FF4B7D27889783DB1EEA7059BD30B9D3E176809066ED1897CD29081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699918, "uuid": "0c45ba26-c7d8-4608-adbe-8888446736e9", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699918, "uuid": "7cbd5037-bf72-44ca-b1eb-0aebb41653bb", "value": "393216:nSEd8CPhm0xmc1qW1+zflnpNm3ID1+TYgqSNDmjB:nzd8C5FWj1pNm3C1YgS9mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766699918, "uuid": "d505fcca-e28c-42e1-a5bf-f6299ac08053", "value": 13383725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766699918, "uuid": "752f3e97-3bc5-41fd-bbbb-9d321e6002a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699918, "uuid": "db6504a8-0f74-40ca-8160-894d3afed726", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2651a34b-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672981, "uuid": "6d1be9f2-a039-4781-9158-a11c5bd42af0", "comment": "Malware payload", "value": "eb1e8cd0855619c0c8a66b7774bfcc2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672981, "uuid": "c387ac0e-7e45-4c14-bc5c-be2cc94e4fde", "comment": "Malware payload", "value": "3ae721cb68770345a910fc7523c27d27c8e52e88f87c35c4549a5b0370ef44a4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672981, "uuid": "1dd0c196-b69f-40a9-a5b0-4c075f067579", "comment": "Malware payload", "value": "a70adf79084f30de38894879bada9dd4fc0e4e3e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672981, "uuid": "8e782e6a-cbb5-443e-9d57-d63b31514a17", "comment": "Malware payload", "value": "de0048ffb8e7710f7154f7f869a25abdddf7b7a3040530e94b418564e8db43312271644d2fd82b0ecc5a038ca65623d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672981, "uuid": "d58b4c40-0d40-41af-a567-40a634b648bc", "value": "T1EF9144102BE03A8137934FF77A27B8CDE929885B3980888FE41CBC5C5D95958C5D1A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672981, "uuid": "0cc09c8f-6402-4c8b-a392-568734499ace", "value": "96:JsYGOgUKJhl+t9JmWX/xaXjG4snA+N81JRs8fNje2IEekhtS0r+j0hdrwkw5kAIs:JsYGOgUKJhl+t9Jm3clO13RIEXhtSnPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672981, "uuid": "e3c9f3cb-fdc7-4525-91c7-93f6da390765", "value": 4502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672981, "uuid": "8ae751f8-9090-4f79-973d-3120c653e216", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672981, "uuid": "47147cbb-f096-4298-91a5-964882004a37", "value": "scope.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0fe509-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626066, "uuid": "9d07383a-7981-4dad-aca7-0a607b62a92e", "comment": "Malware payload (Mirai)", "value": "76a3d09cc49e70956614d13648ff8edf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626066, "uuid": "fcc8ae3a-e096-47a3-bb18-874278130eb0", "comment": "Malware payload (Mirai)", "value": "3afb9255073dc3e42dde306f16d2f1e125b6320a973f1897e1fd80c0ea603647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626066, "uuid": "79847093-13e9-48f4-86bd-fdf4081f697a", "comment": "Malware payload (Mirai)", "value": "62975446b08d64eaba1814d08db5177cf5224923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626066, "uuid": "5a5a1ff5-ff93-4e93-86f2-0b1e2c741751", "comment": "Malware payload (Mirai)", "value": "a5daf88e1b00809f68d75f001d288e2d3c1a97b9163ddd03ff86de2ca4a4a329b957428444363213b47a566cc9359e37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626066, "uuid": "f1af295e-01da-417f-9e9f-c4b29991bbe7", "value": "T114A2D0538A4A2CB0C1B07076DF3E869791BF53BC91F9327452E456E8BA1749740AE4CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626066, "uuid": "fde61602-12f0-40f1-9d50-8c32f56265a2", "value": "384:ZmrfsdF2cdH765GzufZ0Ilkzj52RVdqgkoCPbbMpe74JBhymdGUop5hK:qNcMkSPlyj52/dn2Pbwk+s3UozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626066, "uuid": "eb755973-3093-415d-a72b-796cf33f20a0", "value": 21356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626066, "uuid": "df8b2ff9-0732-4e0e-ae2a-e73a3aac5c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626066, "uuid": "1480c047-2a38-4a2c-aaf3-852b8ad8e0ec", "value": "0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c27e62-e1c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766691042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691042, "uuid": "d4c3c6ed-7f9e-4ca6-bc74-7e2b19cda2aa", "comment": "Malware payload (Mirai)", "value": "a90d0b4d44cf93fb9f2d8c984b828ba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691042, "uuid": "ae11594c-b4d9-40fa-9b71-8e271d5ec51f", "comment": "Malware payload (Mirai)", "value": "3baeff28018b47a4a3d66800de5bb703e80905e1f3e0eb2b7efdb216b38440a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691042, "uuid": "ae681b43-005a-4b32-a8fd-eba483731177", "comment": "Malware payload (Mirai)", "value": "19e7330ef54fe7b5ecc48adcbd1cd610fc41f2f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691042, "uuid": "a1cf65c9-99cf-4b75-9ee8-29b57be943e1", "comment": "Malware payload (Mirai)", "value": "5f3c54738f88bccd114a206255529d52ba1d52930dc8bde97aafad98e86ea97914f5f8b6ec2c125b6eb080bfc4250e62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691042, "uuid": "b9430b93-97b0-4581-8400-0ca982ba7dc0", "value": "T180634B0073588E07E5AA0AF9283F17E4C7BEED4011F5F4846A0FEA164235E735999FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691042, "uuid": "8cff4935-c22a-49a0-a9f9-a6002fbf3ab1", "value": "1536:RlN6BrIbuOX19rk/4uEp9owhYA+kWbIiWy8:RlNAhlw1YA8bTWy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691042, "uuid": "15e7e6b4-d2b5-48c8-8ff2-a62ffe37daef", "value": 70303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691042, "uuid": "3f399a46-b850-45c8-8e17-1e7f4d668e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691042, "uuid": "8a5807a3-dae5-4381-9672-b84e5d1cd4d9", "value": "Fantazy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1e6051-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626362, "uuid": "84955821-aa2c-474a-a406-1c95160ff181", "comment": "Malware payload (Mirai)", "value": "4fd9db8d19eca3d94d95310a4d420df4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626362, "uuid": "236e241a-6430-47ea-8ba7-33e4c83bbe00", "comment": "Malware payload (Mirai)", "value": "3bb58ea23ebae4d5fe54d9fadd6840066b2accdf4ea044e3ca4a887d9ff4f782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626362, "uuid": "5e75cc98-f670-44c0-a3cb-039845e3b1c6", "comment": "Malware payload (Mirai)", "value": "3127a0cd53e2e5a0032ace4607fa0afc6ddd44e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626362, "uuid": "9263c181-c6f6-4fad-98bc-63be9e36be6f", "comment": "Malware payload (Mirai)", "value": "1dd5c33d7c447ccb3d3209936007ff14f4db4ef044846e8b5d74a9b1d0d3fbca69e35258ae94606a1295070cdee670e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626362, "uuid": "8de12576-d652-4c2b-990a-90f60ea2b87f", "value": "T19693B50A6E229F7DF768833547B78E31D78927C62BF1C645D16CEA014E6034D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626362, "uuid": "325da50e-0dbe-4303-86ea-cff57b9c39b5", "value": "1536:L01pu2i2Z38ORmiRmYWDTmCePeeiYeeet9j/BIaVnojsT66A:Yuz2ZwP9LBajsTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626362, "uuid": "29f477e5-1b30-4c80-a8d7-50dfac04dc5b", "value": 92920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626362, "uuid": "80ce1b8a-ecf4-42ea-a19b-6aa7e389cbd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626362, "uuid": "9f3637ce-e2e3-48dc-81e7-7ea0de94ba9d", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3dc822-e1d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766698546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766698546, "uuid": "d7d1f0b8-b739-4fad-8f82-b8207c84bdfa", "comment": "Malware payload", "value": "0909b028d103afac1d650c597be9caf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766698546, "uuid": "236fb660-08c7-4fa2-b046-a7548bd6da0f", "comment": "Malware payload", "value": "3c0e8bdfac9d2a5e3b2ad58cfe513ab23bdf2d2cdb1c8a7655ebf143888b54da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766698546, "uuid": "9d920247-bed4-4a8a-adc1-ac41252e94b9", "comment": "Malware payload", "value": "2603ae8baaf183b3d633590b3cfd2fe507a37fad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766698546, "uuid": "ea69230a-6c94-4265-ab8f-f8c0d8dd9119", "comment": "Malware payload", "value": "1f70569f8650794f7f566af63b33f445e3a5b47b1a1d94359bd050065bbd6dab99802ca4d717efc0cf99e419047192c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766698546, "uuid": "19ee4962-8b19-4432-a0a6-78261988e803", "value": "T171187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766698546, "uuid": "828f42b2-a64d-4c3f-b046-57ee00259dad", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766698546, "uuid": "44ea0fbf-b78d-4f31-9a2e-e20198f2ea23", "value": "786432:9AZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:9AZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766698546, "uuid": "5f2696cf-33a2-48cb-8259-c78f6e567ac8", "value": 90446848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766698546, "uuid": "d4d30047-7487-4351-88ce-975540710d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766698546, "uuid": "4775307a-5c06-4367-9a0b-1ed695fc82c7", "value": "MyApp.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9ea5ea-e164-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766648136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648136, "uuid": "ee344d9e-ae34-49db-8188-028a45e3dfc8", "comment": "Malware payload (Mirai)", "value": "72b50c5588171254844526ea4490671c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648136, "uuid": "4b5812f9-2340-4758-b7ac-cd9e0a45dab1", "comment": "Malware payload (Mirai)", "value": "3c316a239ab6ca6dd9126e4cbf2f3c861714be60d1c1cdb0ebc35f2fdac97a32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648136, "uuid": "ea805a9d-756d-413d-893f-0fe0183940fe", "comment": "Malware payload (Mirai)", "value": "fa68fb37f54caf51695c16587d101de7562e89f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648136, "uuid": "c1533622-bf06-4563-b436-25175865a45b", "comment": "Malware payload (Mirai)", "value": "8e39a1179bf1476ef9d78128371aeaf8971ef2abc575b4a677612f201908e1bb89c8d08c376ba17584b11282740fd8ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648136, "uuid": "ca556287-216c-4e05-ba68-e7d848cde829", "value": "T141430885F891DB12C6D1227BFF5F829D371713ACD1EE72039A186B65368B86B0F3A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648136, "uuid": "e1b7fdf6-8d54-4529-9b1f-b99f2eb3496e", "value": "768:2sO9u7pXjOV3QMo+pKMSXthKIAIcTNKvDPE9rqi95Eo1YCfnelkSM9NNvGTw:ROEKioKMSdhAGvzMe+l1g1INvGTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766648136, "uuid": "5fab4341-30c7-4169-a165-02c73a7c5c04", "value": 59692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766648136, "uuid": "e05555c9-de40-4b62-981b-5b4feb1d9960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648136, "uuid": "2c70fc0c-f49f-4417-988a-9cc21b0cf062", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213f0a3c-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700890, "uuid": "5b27fbd4-8cfa-4881-9cb2-f33d8ca1c41a", "comment": "Malware payload (Mirai)", "value": "116a3f7777475839f62a3891f3a425a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700890, "uuid": "9e9c4dd9-1ed1-44a6-a12d-0ba7dbb84f2e", "comment": "Malware payload (Mirai)", "value": "3d85feb632a7ff5a6e683ade7e9e5898aa2011bf4692cf0c918775f31b8cce4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700890, "uuid": "918808a8-5835-4dd1-aa23-33789e4e71c1", "comment": "Malware payload (Mirai)", "value": "0907e1ba54ea84703a34a795800407e61e7bc008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700890, "uuid": "b6ec7483-be37-4711-be45-da797eb00200", "comment": "Malware payload (Mirai)", "value": "e8416d29ed82fe1e0011df0ff540fe50c455bc5b34fdc01f9836083dcac84c07d24342f995ef97a3104d2b60aed6a09c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700890, "uuid": "8503eecf-f74a-4bc2-90fb-05531597bada", "value": "T178C32902F88580FCC08AC130177FA63A9936F1ED5238B6EB6BD4EF127D4AE515E1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700890, "uuid": "3667c13e-df00-49b2-a8ca-e609a41e5ad0", "value": "3072:RBhGd35XwK0CLhmCGF63pcHHskWv942OH4xPXmqvln1Fwv0ffgoGCyi9:RBk35XwK0CLhmCGF6ZcHHskWv942G4wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700890, "uuid": "7a1da797-5ffe-4ec0-a971-d375889c091e", "value": 120816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700890, "uuid": "68a94048-a3be-411a-b055-554225c4bc0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700890, "uuid": "f80f5b26-9890-48f5-80b1-d57478b6ce43", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3231c8e-e163-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766647877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647877, "uuid": "b90102d7-fad5-438c-ad8d-32e4e13a2a8e", "comment": "Malware payload (Mirai)", "value": "926cc352a5009967b7b2f7efbca64e06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647877, "uuid": "a9ff600f-333e-4e13-b5e1-30582e52c03c", "comment": "Malware payload (Mirai)", "value": "3dd0207758e812a332482ebc812f24824578f136d134822ced6282c59fcdb633", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647877, "uuid": "38a9be4d-11a1-4026-9d77-57d2d9d4c19c", "comment": "Malware payload (Mirai)", "value": "6ff57e9b52a29f3681a682ef9d4a9e87a12905d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647877, "uuid": "cd93027f-6d7a-4caf-ae0b-d2b52ed3aa39", "comment": "Malware payload (Mirai)", "value": "1aca08d8fd8433f06d07fc3bbac6e99b8bc362c7c9ff062974f171322979629cdf3bfa65ae0b902819e95e27f5050a81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647877, "uuid": "6314d35e-fede-4a30-8f55-9851edb5e12c", "value": "T1EB43F741BCA2966BC6D063BAFA6E518D336673E8C1DF3257CC104B017B8951F4E77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647877, "uuid": "f33ec6f3-d855-44bf-b07a-8659f7ad3429", "value": "1536:4UFW3u9NpVVrOQPjlh44tJc/Rz9VvF8w+:4UFAu9NpVVr/lh+n8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647877, "uuid": "d86b0d97-5956-4ced-949f-7af215c3f5d3", "value": 60328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647877, "uuid": "829ff00f-26a0-4bf8-82be-5be6901269b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647877, "uuid": "d3de12e8-8386-472d-8b7c-f40315c0dc89", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14d6b79-e189-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766664302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664302, "uuid": "149d1af1-da4e-4fff-8f94-2272268e4ae8", "comment": "Malware payload (AdaptixC2)", "value": "069ac792037506df2d926ad53702e2f6", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664302, "uuid": "98ccc5c9-e334-419a-b7f1-25894bb9559c", "comment": "Malware payload (AdaptixC2)", "value": "3e375ccf690ffb190591945c540941b5c3f17b87c8de938fffd1661c3a84f367", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664302, "uuid": "28423138-140c-493b-a588-40a9cfeea506", "comment": "Malware payload (AdaptixC2)", "value": "b410c984416c51473b73970044117a59a59dd64f", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664302, "uuid": "c588a33a-9b0a-49f0-8a5b-37b22dc3d285", "comment": "Malware payload (AdaptixC2)", "value": "0a359a521b99fa082303661ac23c10d2fea04e555980847a4de48ea73608daec69b55ef9acc82075fb3dbf60001f832c", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664302, "uuid": "a379ab2e-4a1e-4d21-b65f-1ec51009e02c", "value": "T130836536E6B3C4ADC06FD534AF43A4B7B9F17C584534661947C1A6223B2BD386BBE240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664302, "uuid": "56209133-8986-4cb8-91db-59c21c70f59b", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664302, "uuid": "9b1241bd-cf72-4a8e-a61e-a95c0837701f", "value": "1536:7uo3eqVEq/b9IW2BrlP3O3coXxaF0dbVSNm1vBf6RvjrXPaQk2/a:39QYZZhth8vHXSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664302, "uuid": "d263afe5-390c-4fe1-9894-2aa5f41cbf49", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664302, "uuid": "217e0b63-f52d-4598-9740-1f64607376cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664302, "uuid": "da872fdb-e190-4763-bafc-b47540b8767f", "value": "069ac792037506df2d926ad53702e2f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0be648-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766665530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665530, "uuid": "671c360c-c60a-4aca-8f1b-f15632fe980e", "comment": "Malware payload (AdaptixC2)", "value": "42aa979f9af39fb092113434e0990002", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665530, "uuid": "6d9768b1-b142-4113-bad4-c42322ad92ff", "comment": "Malware payload (AdaptixC2)", "value": "3e903c148364b388c2b0a169114854f885c4945e03a5ae023bc18d1bcaea0cad", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665530, "uuid": "fc48bf5c-a0e7-4c29-b05b-7e727999cec1", "comment": "Malware payload (AdaptixC2)", "value": "b98093cd0d4fefa05d4b46cc3a72078461069c7e", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665530, "uuid": "ba38c960-4ac4-418a-8957-ffa39033aac6", "comment": "Malware payload (AdaptixC2)", "value": "e43c2ecd2d2eed97d30433aa10676e7ddf9ef722002f83c9b4bcf5ee282920b4d1cdf92b702544eb0fc4cf4cb623621f", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665530, "uuid": "253415eb-9c0a-4bf4-9e14-f08f34605f95", "value": "T168C2E063DA10B2EFCB4F86F1C9F088D129D0F4799F450614452A936866F07F6E8ADAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665530, "uuid": "6197ddb4-fc13-4861-b7ad-0ff2016b40ed", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665530, "uuid": "e7b97a82-8ff4-46ac-9019-82f0bc119114", "value": "768:ov6PqxGKp0cVxiTJS+0PqjusXerNA/4+o5IAmChfZA:ovzGG0/QqjuyUNY4+oGAmCBZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665530, "uuid": "728bbf86-db45-4216-a990-69ba0379e956", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665530, "uuid": "52130c14-c1aa-4099-9c50-440c2b55ec69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665530, "uuid": "d194baa7-f815-4a4c-a11c-975a0e93269c", "value": "nodejs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa245cf7-e1b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766684369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766684369, "uuid": "ef5fcb14-135a-476c-a7eb-0c86b64ed9cf", "comment": "Malware payload", "value": "b2d4b9007f86f2893cd74e3e3641c87e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766684369, "uuid": "966dc793-69d1-4d57-9702-43c6fdf80098", "comment": "Malware payload", "value": "3eaee77ccf4bd95e51f8f69b632df63edc477a40ed7b2b15e4e156364ec26ac0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766684369, "uuid": "f19b5b3b-33a8-4d6e-9233-2c16228d9a00", "comment": "Malware payload", "value": "97198c50b6e2c1ed653d5b30fcf35c3b9e2ed12e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766684369, "uuid": "903c76e4-f2c6-4cef-b23e-5f3c7991d550", "comment": "Malware payload", "value": "f262fd7453e0f3bef5571575153af04ac654627585dcfef1dcc1f182d10372a6ce85f771a63d3f0380cc314e2f4faf53", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766684369, "uuid": "ed087fdf-4fbb-4ec8-8c32-c95c8921ada2", "value": "T1FD11CEAD2190582988EACC0D32E90800A63FD58979619F38DDF9443740F7ABC7F6CE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766684369, "uuid": "68480c1a-d93c-40d7-90d0-1980e9402712", "value": "12:zD3XiNIBS+JoKSrSxHXjMdl9AXn9oaTxyTF6thyrQkn:z7iNIIXKSrQ3wdl9A3936WOQkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766684369, "uuid": "7f0b93bf-09f3-4a41-a169-2a92a3ca2bc1", "value": 880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766684369, "uuid": "74d940b3-3770-4310-b56c-9b020688b06e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766684369, "uuid": "77425c62-4332-4ac4-8090-b0a2e8539140", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b96e7c-e151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766639873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766639873, "uuid": "b4e60ada-686f-4683-b442-0f79b7efd137", "comment": "Malware payload (Mirai)", "value": "8bf04371f74bfe642333647d6155b5c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766639873, "uuid": "291c828a-f8b3-4a8b-839b-a8c5d2af2e6b", "comment": "Malware payload (Mirai)", "value": "3eb29e409ab731d574aa7bc550ed827f3fba1e5427ad1964323d6aef2e6a1428", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766639873, "uuid": "3bb51cb7-ca09-4840-8ee7-44bdb1886800", "comment": "Malware payload (Mirai)", "value": "0e7249e0ed76874fb211d267507ada7cea58f97a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766639873, "uuid": "22423102-7e16-4ba0-bf5e-420d6dd3dfd1", "comment": "Malware payload (Mirai)", "value": "a55babd97f7bf85da5e81910c068ccf577ab5cf090990e3c296b33b5cfac66304da8e14acc8fcfc01f535aecb05ae655", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766639873, "uuid": "cd7f869d-093a-4245-bfee-2f292dde9985", "value": "T136634A21BDB62C17C5C4653E51E34235F2F7574634AC8B2B7DA20E9CBF25A403217ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766639873, "uuid": "b1bf587e-afcb-41b3-8d68-6be063ae2678", "value": "1536:nZeo1aVWjsEQK4ujqLPYk6rEpdRkjXoYTzAj2:ZF1wokTYkS+bTYTzw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766639873, "uuid": "0b45ea54-f58d-48be-96eb-a1234b153a91", "value": 66748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766639873, "uuid": "76865801-97b5-4bdb-ba2f-897dd428befa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766639873, "uuid": "c8985826-6105-4cb4-ba28-ceafd1502a80", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28672b38-e1c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766691453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691453, "uuid": "9fd5495c-6fd8-4226-aa64-2539e04c8f50", "comment": "Malware payload", "value": "c50d2948c471f2f7a9bfc54649d468f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691453, "uuid": "da20a983-09ed-4135-8178-defe5f7fca65", "comment": "Malware payload", "value": "3f30480aae0139e22bc4343be2a25c2af76711ed81e0f01ef34328eb39cbf360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691453, "uuid": "e7ca646d-3662-45fd-9a41-ff61c8d1609b", "comment": "Malware payload", "value": "555232b267329108a89e98010238bd4abeb0a650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691453, "uuid": "80aaaace-8f7d-47e3-8e3b-4820b6575536", "comment": "Malware payload", "value": "941d176af2c6dcf8c4032632d1b0876b280d01000d3160d01a33f442230bbc974e4a8af2187ef6928e7192d228ed6898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691453, "uuid": "599fe8ea-e43d-4fec-b7da-e7dd477d5590", "value": "T134C41A7DAC60F362F608D0BEE185D3529E2178110236AAD319BE932412459B3DF5B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691453, "uuid": "850e93ad-8f0f-4a9a-a5f6-e49d48535039", "value": "ec4a3e507f2cadcaf4f3ba70774863e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691453, "uuid": "1deb5ff6-148a-4a55-bf5f-adf1dc41c1cd", "value": "6144:Piy/0WhBGtUK8z88VeLQiI8MvCobILNkJnDCikykXhCgp/1JsUzvE4w6JOOunamb:FcDv87KkkykT/sUAgsdBiBNlin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691453, "uuid": "ed5afe54-ae75-41fa-91f8-0aa1fe537910", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691453, "uuid": "f4cb45d3-0eb3-479b-b307-4b6a6a56e98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691453, "uuid": "ddc14d77-f3ae-46a2-8b42-37d799cfc9f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c150c6e8-e19c-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766672382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672382, "uuid": "6ba3452c-fbae-44da-89a2-fbf8e58061fb", "comment": "Malware payload (AgentTesla)", "value": "bdd3d6f541bf3ae671650f6f2c20a3a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672382, "uuid": "8cea02bd-d717-4a3f-aaf3-f00501c15ee4", "comment": "Malware payload (AgentTesla)", "value": "3f9efc4109e00b310509ad48293a3269ec5f13e26b99d99596afdb6627d8caa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672382, "uuid": "7e900fc7-4ac4-4e6c-b824-968d365c0b3d", "comment": "Malware payload (AgentTesla)", "value": "fc2c6acfaa7d2afef4fe2f6b7203bfd18b56332c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672382, "uuid": "2ae24f3e-6c06-4bd5-a4f4-91b71c0a20fb", "comment": "Malware payload (AgentTesla)", "value": "33de56271d9472b3f821aebde65030dbf955620294729016f449f0b8ce6921ac645476afe003096f67ba8ffbbf4de3a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672382, "uuid": "dc411d75-4362-47df-aa43-222abb01726a", "value": "T1EC03728C7EE2F9A0536264632D6F609BB13E1C44B44C41F5F2A6E184F97C70DE17AA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672382, "uuid": "bdf84e6d-3c51-40e2-b6b0-3791d31c5d0d", "value": "768:BLNZxMiGKKlhX9vcuRshKNXx/6+13s901WLN24vlGg365P9UzQE:pxUhX9P4K++13wmUzQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672382, "uuid": "a33e25af-c8fa-42aa-a0cf-3c51e3e4f5cb", "value": 40706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672382, "uuid": "b4f418f5-b57f-4556-87e2-dbd8f3e94f23", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672382, "uuid": "d0a744b5-ccea-4770-8b3e-baba392304d7", "value": "mintxClean2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac03a2f7-e1dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766699834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699834, "uuid": "8bc21b27-6bcb-4766-872a-c647a6d362d0", "comment": "Malware payload (Mirai)", "value": "271a1fada5ca1cfdda7df3f4639c4e12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699834, "uuid": "d2f6cc3f-d290-47c6-84fa-e46798d7f794", "comment": "Malware payload (Mirai)", "value": "41615ffaf2bcd80f2022c0438bbcd503cd15a2cfbc6ff1bd5e602d1bb123e781", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699834, "uuid": "c03f3443-ec1a-4943-b85d-ffebe248ce9a", "comment": "Malware payload (Mirai)", "value": "2ed63bb126820dbbe96b492c265fe5c1864e0d49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699834, "uuid": "9f57fd12-626a-467c-b0ac-7b3c8ba5620f", "comment": "Malware payload (Mirai)", "value": "dfe96e772c18ef2288f93f269c36d828713041566adb6bef9d68d42fc2e4eaf2c84d2445a907af562f96843a4b6b804d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699834, "uuid": "6027fbca-8f8f-4419-94bc-d3101d972a81", "value": "T19D334B21B97A2E17C0D5B9BE22F34724B2F5171A26ACC65E7C720E9EFF1494021136B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699834, "uuid": "0e14a9c1-fc9b-4cf7-a01d-dd6012ba4a18", "value": "768:Mno0q9GakMQ6DXZnNuStFSOVWOQrprO+d5nfjzKx:Mn9SG9MQ6DpnNuStF5VWOUtzrzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766699834, "uuid": "d67455d6-0e46-497f-be09-4114fe0661d5", "value": 54076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766699834, "uuid": "521cc7e6-d986-4629-b3c5-85c84c898b74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699834, "uuid": "12c7e83a-8fea-4f9f-bc22-7c757ce2a6a6", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcc9685-e1c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689958, "uuid": "7f7cc8c8-9762-46aa-ad2d-137d5fc6ac76", "comment": "Malware payload (Mirai)", "value": "2e3862dfb02a059489eb78402f918768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689958, "uuid": "77201f5e-bc27-437b-8a28-0b8093b1bef0", "comment": "Malware payload (Mirai)", "value": "42238e829271f2485ea8c6e10a7b94b94ea1446457aec0a533d27e7eda09d943", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689958, "uuid": "7ddb16ed-38fe-4c3d-9c84-229ac8ba0b66", "comment": "Malware payload (Mirai)", "value": "e0b591d49c8d99577e40840e87e0aac556d231fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689958, "uuid": "3c77ad39-dc43-4312-bf2d-8a3c78a4514e", "comment": "Malware payload (Mirai)", "value": "4fe79d446cd22708d6aaa93cf8f20d56abb7c73a32b54c70280e7d8f4e68948faa3f6c6058153bbfb12678bafda8337b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689958, "uuid": "0dbb97ac-2a5e-4658-9810-c0c9d3e8ab8e", "value": "T158F3BFA7B30BA050C8E54AF45BCB6FAD292722009E6B94E77C2D323656775DF180B3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689958, "uuid": "4320a984-bb04-4f61-8601-11af804a83fc", "value": "3072:a7sk3hNhWHmHkQnG1e/K3LlJ5Rlxqvnvg1CwLQUc14hq1:aok3hNhWHmoe/MLlnDYPoCwLQUXhq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689958, "uuid": "aca35639-2600-4b0b-a46a-517d93cedf1f", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689958, "uuid": "b0635932-42f9-4ed7-911e-604b1502db18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689958, "uuid": "7c0bf54c-ffd2-4d0a-a7cd-80e6b9170331", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ea4014-e1bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766686477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686477, "uuid": "d5ff823d-deeb-43fc-8715-9d17ce0c459f", "comment": "Malware payload (Mirai)", "value": "37d68ab09e0f74f5b82ca677f825f2b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686477, "uuid": "1ec522b9-9da0-4f2f-9b9f-8d755345cbc9", "comment": "Malware payload (Mirai)", "value": "4271188473a54c4b8bf25e2eef1267c0dc051b2da8103275cc29e00bffde83c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686477, "uuid": "ae7e746a-bbb8-4a40-9629-3d9ea646c62e", "comment": "Malware payload (Mirai)", "value": "c5f88cb37612f534e9c4d5618997258378be5b16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686477, "uuid": "854f9b2f-70b4-401c-a93f-0705d1656035", "comment": "Malware payload (Mirai)", "value": "9f912275614785a7cec36e2006384465b30fabc67c48663ef8a8b7073287d077ae7d4d878ca5dc5ad52647f165bf4a51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686477, "uuid": "d4a66095-56c7-487d-a7b2-13233762077b", "value": "T16F837DC5AA43E8F4EC164271213BF7335B76F03E102DDA87D3A9A932AD42A41D64739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686477, "uuid": "a8ba9648-00c5-4e94-b7f8-a1325228f69d", "value": "1536:+S+BO5Z+juK52mfxIWuF2qwK0IQZtqNRs8MKtk+QTfju7RGmC:zoO7MuK52mfxIR2qbPMtqrXk/TyFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766686477, "uuid": "ecd8a639-d551-48c6-9c41-a0446bb7fb35", "value": 83024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766686477, "uuid": "a10719d3-4929-464b-b595-76199bc080b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686477, "uuid": "29e26bb4-8b6c-4454-b1a5-71d10b361400", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21595941-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690152, "uuid": "8afd19c9-de5a-475c-891e-3ac9d23794a4", "comment": "Malware payload (Mirai)", "value": "ab4bafbb4d07a2f97b7a3e96900ac8e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690152, "uuid": "832ee8f7-8b77-4b3e-9d67-852875c5fad1", "comment": "Malware payload (Mirai)", "value": "429fa603e41e304fb6abce2cea372e692649dea1033bd2731c35ada775b920c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690152, "uuid": "70fbb244-22f2-4dc6-a7f5-6e7fbf5bc880", "comment": "Malware payload (Mirai)", "value": "cbbca1e04c0d2cdd19acf5aafb960c9fb0ffde64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690152, "uuid": "66818dee-747d-440f-a8eb-49fa1f01aedd", "comment": "Malware payload (Mirai)", "value": "467852df344788e3633e5bbc661b5a092a0680aa290e5f98b56c474a48245a10e389c77493a35bc68837e2897174c1bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690152, "uuid": "c8d9428c-fbc1-4b9a-a8c4-04f13e415447", "value": "T19531419062D05EB8C8E891BFAE52471573A4DF88E0C732A3C2087719BD2EE7C5D27086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690152, "uuid": "440cead1-80c7-485b-a7a6-39788b9b4977", "value": "24:vKGpa7Urz/jlfGOXK1hoVev3gRGaJ9iMDBBurGnlxrR+zz2KpQt:vKGpa7UrLZeb+J9BurGnlxrszLpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690152, "uuid": "0f2dd892-7f81-4f86-8512-b59dc663049c", "value": 1460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690152, "uuid": "6122b2e8-3ce1-4f96-8a87-87e599c9885b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690152, "uuid": "cb35fb98-9785-42d8-9dd8-94910e56024d", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e395830-e15f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766645909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645909, "uuid": "443a9784-a929-4e5c-ab2a-84be5f5e6bd8", "comment": "Malware payload (Mirai)", "value": "fd872e69f8f73df411111105e649b37e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645909, "uuid": "95548719-745d-4a78-8f32-f31173e26dfb", "comment": "Malware payload (Mirai)", "value": "42e68f637bad2c6fc00d113e5df1c48896cc8bbc7d056fc224b5582214fead78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645909, "uuid": "ff6dc25e-2027-462b-bf14-403d846a6b45", "comment": "Malware payload (Mirai)", "value": "a204b1c6d56b684a3a6a632cc14f59116972050b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645909, "uuid": "78b51b29-8a6e-4691-8f91-eac984835bf6", "comment": "Malware payload (Mirai)", "value": "b7d8b1b96f23cc1da433d8a038dd98b71ba5d69be8f61be5fea4a4e9a96cd134ce1055178b4ebd7b3be0a479abcc414f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645909, "uuid": "3266107e-db4c-419f-b109-1f3145b0fa84", "value": "T1AE244A02770D0E03C1532EF0263B1BE15BEFFDA128B5E681755EBEC59271DF22489A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645909, "uuid": "044da284-cd5a-48c1-8b49-20b71eba4d8c", "value": "3072:jbcIyzNIN+02tWxeeTTc5ooxoCNsc7ZnGVlS8IRj84nGc/:GNIgnYeMQ5zxBsc7ZnGzSjjH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645909, "uuid": "163eabe2-fd67-4efa-83fe-273accbc8c87", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645909, "uuid": "4194bcbe-2875-4949-857a-ceba7cce9a96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645909, "uuid": "f835d413-2651-45ce-9dc9-a7a14ba69190", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02670a79-e133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626964, "uuid": "2241d316-0680-4832-9f7d-af26facc85e0", "comment": "Malware payload (Mirai)", "value": "408171fc60c66ebd69158a3a38033f43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626964, "uuid": "656870e1-6860-4bfa-aedc-af52eff6f355", "comment": "Malware payload (Mirai)", "value": "4312bc23da1046b884de3be3326540afe18b423df3b0f13958219f87fceb81d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626964, "uuid": "499097e6-2c1c-44c5-bd4c-cbc608c03cdc", "comment": "Malware payload (Mirai)", "value": "07cb428b592ed1f1076507afdad8ac088fb98194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626964, "uuid": "3cc8b77a-6c35-4257-a3c9-8b1feb2c5f64", "comment": "Malware payload (Mirai)", "value": "50a07459d811cf8541a99d8b947b1adb74579fe43355265e5ee247e90efe00a2dc77e7b62a8b07cbc8411b0be820def0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626964, "uuid": "32fa0acb-b8dd-4376-9df7-df0f26b70891", "value": "T114B36D42BB42C1F5E4AD42F220375F375232D93A4021DA41CBBD9E32DD75A42DB6A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626964, "uuid": "a429b253-8a36-46be-a036-cb5af0dbf8c0", "value": "3072:nDluw40wAR77UNN69mKtW4o3CRUIM594j:nDlhAqC3+k5Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626964, "uuid": "533bb743-6940-4575-9fc2-c0ad34c60227", "value": 112964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626964, "uuid": "579548d1-cd32-4881-8372-092a8efbb96e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626964, "uuid": "f0d6c299-0844-4710-b9a3-5383360d71c2", "value": "rondo.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b953726-e1c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689418, "uuid": "ae076ed2-c941-417e-83d2-3f30ccfb8b29", "comment": "Malware payload (Mirai)", "value": "0e58d3e24d3a98d8f087338158acc13f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689418, "uuid": "a9f72618-a66a-4af7-ac72-b436efa33f36", "comment": "Malware payload (Mirai)", "value": "43281f604bb6819feb5ac37035f5edb9ea59cdf1c1a4c85593b14c3de7d234c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689418, "uuid": "2e4f243c-41bb-49d2-9a18-fc64b79412a0", "comment": "Malware payload (Mirai)", "value": "8fa2a6dc9b9aefd985cb95e66c3af45e14e2ba9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689418, "uuid": "413a3567-038e-4807-a725-7c6aaa189bfa", "comment": "Malware payload (Mirai)", "value": "01ed9910858e4c58cc10499465d2ce1106f1cc33bfe1418bbba3c347d08a9594be292126115ca975e2e7f9f7a526897a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689418, "uuid": "17e0fd4e-573d-4883-835d-408806a58eea", "value": "T19493D559E9818A02D4D926FBBB5F119D33072768F3EE3202CD205B25778AB5B0F73A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689418, "uuid": "d971b8c4-0483-4e72-abfb-e1a8f7cb4bb4", "value": "1536:kFnOA82xF4MCvNEpchDjF2cz2ULyNHWnw0Q0pTI+QldR/TmloyD/ie0VFiIY:OxbctjF29ULy1GpTI+QldG30fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689418, "uuid": "34bd45d3-9333-48ab-bc73-1e7760af0e25", "value": 95752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689418, "uuid": "b119d551-e772-4536-b66b-4242b1af18bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689418, "uuid": "c133eebd-36da-4f46-8f1b-ad16273c690b", "value": "shadow.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5161ed-e15f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766646228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646228, "uuid": "4ab2f757-614a-45bf-980e-464cbcd9d947", "comment": "Malware payload (Mirai)", "value": "cdc6f6ec746342910d4bdb6db3983619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646228, "uuid": "4a0d172b-e614-4a3e-bc02-ba8062d652b2", "comment": "Malware payload (Mirai)", "value": "438399d19a36a8b9ed04504a69b9e5255877883dd1775b44e06f92b1a29a2418", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646228, "uuid": "eaa4bdad-c197-49bc-9c9c-f92cb8a5d5fd", "comment": "Malware payload (Mirai)", "value": "cdf5d7bc142b09ca0160082c709973f3f90540a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646228, "uuid": "181d0fb8-726a-4df4-a6db-156a62293675", "comment": "Malware payload (Mirai)", "value": "21d4778d4161f345039c48be31db203ec0ce303a24ace3e921b2f56bfe75540df03977e87dcfac5c21f99ab3f9efa782", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646228, "uuid": "21ede920-0de5-46cb-9ef8-e7b84bd1a530", "value": "T12BC3B70E6E219F7CFBA8C23447F78E21935833D626E1D685D15CEA015E7064E742FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646228, "uuid": "27ed9176-a827-4e39-8d64-5eebcadce51c", "value": "3072:pa4dwJZrNKG93ewfNr/S8k6N7T8Tqo1zUzNLu:zwJZrNKGtewlW078x1Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766646228, "uuid": "ac0794a7-a8fa-4caf-b50f-23e42a4c4d6d", "value": 121816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766646228, "uuid": "47147483-7354-44d1-929e-c6cf141b572f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646228, "uuid": "afec34e1-06b3-45ec-803d-4a89d6280768", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f3c9b4-e1c1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766688120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688120, "uuid": "e4cd837f-fa4f-47c4-a137-69ad8c1ce70f", "comment": "Malware payload", "value": "aee3e1f308231c8a446a0b6191cd45cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688120, "uuid": "6481622c-6cfa-4c2a-9b17-42bfd94cc972", "comment": "Malware payload", "value": "43d58ad5b5253f34fd8b3366af953af9d7ac3f1bbf32d2d563da03e9dce83d42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688120, "uuid": "c2aa0c7d-c54f-45a5-9400-93e5af7c55fc", "comment": "Malware payload", "value": "05463460c8c78c8b3fe38929abcac9b7238ae2fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688120, "uuid": "02e37f0b-48e8-42c5-b1dd-fa0290349923", "comment": "Malware payload", "value": "0f33a5773832c4ffbb1694903f2539ca7685f530fb74709fe6c31828877ff7f7dacbf796ec7e2506e811fe4849ab7212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688120, "uuid": "1f59e5eb-4a59-4504-a129-8b8274be6a7e", "value": "T1A7086B4262EA05C4F9F7DA758AF65617C673BC122F3095CF221C17291F336E09A76B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688120, "uuid": "75ca93ca-c2e7-46df-88ce-fb6edb4ddd96", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688120, "uuid": "32900a65-ebef-4ead-8700-2b7f2cc72f65", "value": "393216:sIFqKb+iUHdZQKPAg9hAJLPU689cN0DshEQu58EASEhoIaE2lShUcBs4DJ7G15Po:sndQmQJhnVn0vSa5rs3wbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688120, "uuid": "fcca25ca-5dc6-41a0-a055-608887059819", "value": 82258618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688120, "uuid": "d4b96b34-129e-4878-aa83-32ef924cc1fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688120, "uuid": "50b10287-efff-4005-a7de-005c5bd96a62", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9202750-e17e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766659483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659483, "uuid": "4ea677ff-b1b3-4afe-ab1e-2b7dd697210e", "comment": "Malware payload", "value": "c5d96bc1b282d960d6242567b0e42bd6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659483, "uuid": "174d6b0d-1518-4c6a-ab0f-2de753c888e1", "comment": "Malware payload", "value": "4528c6522ccf4997508538e7cf111e3ac504dda6efce62ccfbfd68e022a63e12", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659483, "uuid": "dd942383-ebf1-4fd2-a0d9-937700e54a1c", "comment": "Malware payload", "value": "0075d7251d3f6dc28294dc03224854646e69e5c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659483, "uuid": "591b0a70-36a7-4a7e-92b2-64d9586b8c46", "comment": "Malware payload", "value": "795f92b05680937e103c3e4e8301f5a7a2b50ce1c3030d1b95503b8a62113546848b9d6947e0bb51967838488f406894", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659483, "uuid": "00c9cc44-d892-4a68-b28b-c074e7112ed3", "value": "T1A31124DD3C643638A90FB9C4306D1A086B8B8FC5B03ACB14A58404A38985911FF69FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659483, "uuid": "ea6dd8b2-b137-4ec5-b105-0f54d4c1d720", "value": "24:I7YyNNIG0RbKTRDn+FRwNfmR0IneAGUYxv:xmye1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766659483, "uuid": "28b68299-be12-4cb0-9220-401c89874831", "value": 1054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766659483, "uuid": "2905da7b-1c20-4331-9822-b3f1c883de49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659483, "uuid": "4edab1cf-6b18-477c-9868-3ae4d798ac5f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c88214-e1ea-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766705727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705727, "uuid": "44b55597-a1cc-400d-a497-185a6784dcdf", "comment": "Malware payload (AgentTesla)", "value": "2029a7514371ad92aed661c171836120", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705727, "uuid": "351dbe09-a52a-406d-ba47-1596a3b2b30b", "comment": "Malware payload (AgentTesla)", "value": "458c119a3b7fd9a59a26a9f0af3f6490f131d5d5a6a01f293b728645df9f50cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705727, "uuid": "d68c4923-6133-43c5-a386-068a6950817c", "comment": "Malware payload (AgentTesla)", "value": "a23c39b7b0fb8f6e3e614835b0969bf87e4dae1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705727, "uuid": "1fb7465b-7531-4426-a558-a347cff30f03", "comment": "Malware payload (AgentTesla)", "value": "44574c7a0938b02efda61ba70a6b26e45445a6ce2bdc06f7acd351f69807b3a4024f9b67cae32c4da66e2ee187d6158c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705727, "uuid": "b6282665-0dbc-45a0-b967-1ae476c27b1b", "value": "T1B545BF0273C1D062FFAB96334B5AF6115BBC79260123A62F13981D79BE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705727, "uuid": "9cf42525-3481-48c9-b5e5-ae182e842a82", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705727, "uuid": "099a5d31-6975-48da-b75f-ef17d5599ee0", "value": "24576:X5EmXFtKaL4/oFe5T9yyXYfP1MAXDzD6i7VNKrV5eT47pu:XPVt/LZeJbInGizD6gC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705727, "uuid": "e6fe4318-4900-47a0-b60e-5e8d3a2a6791", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705727, "uuid": "a83f81f6-760f-4d7c-bc55-d2ab0a6c2693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705727, "uuid": "2f825d29-1d97-4543-97c1-1c04456ba303", "value": "tmpcih5l97u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a449d85-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690328, "uuid": "be2d8918-ce9b-4b37-8884-d48859b4f8c8", "comment": "Malware payload (Mirai)", "value": "fba5c3d80fd861fbcf488eccc6643f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690328, "uuid": "3931a87f-1fc6-4e80-ba92-ec55bad1e38f", "comment": "Malware payload (Mirai)", "value": "46588e27520d4ff181d33bc7ff021903d1ecd13f376657f5db7af180ca2e3ac6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690328, "uuid": "90181fd4-8e6f-43da-aac9-c38748cf3687", "comment": "Malware payload (Mirai)", "value": "2fb0f4da8e874d1d217af4b234a200dcf9470532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690328, "uuid": "080a285e-504d-4694-add0-9bd3692b80e8", "comment": "Malware payload (Mirai)", "value": "777d55bd12928113dbf752b66b652e19fc0b7dd86620210e8ab28290d6c2da674a75f311b837be1ad826a9f32a7e715f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690328, "uuid": "5e0e89be-5163-437d-b67b-3e26d9f43e51", "value": "T13EE34A95B8828A22C9D513BEF92D01CE331367A8E2DE7213DD205F2577C792B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690328, "uuid": "aca83c55-af72-4970-8da6-bb075b826c38", "value": "3072:mEeiHci1tuuMXL3B8O0Vr2agNPS5VdnlMEjkP:yi8i1tuDXL9092attnlPkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690328, "uuid": "a6dbf9de-7b81-4e1a-8068-a4f3c252f1ca", "value": 149108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690328, "uuid": "a788db3d-20a5-483f-9536-44abf0497021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690328, "uuid": "343ced8b-6d77-4c74-8f5b-d659cbd0a892", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e951d77a-e19d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672878, "uuid": "06882d70-6b8f-4136-96e7-423c38b05403", "comment": "Malware payload", "value": "e2e337df43653aae1effaf442322f6e0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672878, "uuid": "a21b54ba-80a5-46e5-827e-153744e0915e", "comment": "Malware payload", "value": "469b13cac1eb859da7ba4b597270f047b11815bfff9c4ad3faa5617c07a6c3e0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672878, "uuid": "845b79fa-3a66-4f1d-ae1e-7d1cc4c04eef", "comment": "Malware payload", "value": "7fe046eefea1ee9cdb6a7e2fde43a5d637a72307", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672878, "uuid": "3ff96e80-a840-423a-8197-696099200fe1", "comment": "Malware payload", "value": "5f01a0bf45affb1eaf0acc1169e54f04053c03c5fc37c3fdbeef78997eee6adc0a92b4ee34115f4331808edf87ca76a8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672878, "uuid": "ab91bd45-c0da-41c5-99fc-5fc54c042233", "value": "T101B5EF46BB989F1EC87791360D4A53316059EC23C753C38BD8796B59286F6F80F063EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672878, "uuid": "5b1da1f3-40ea-46bc-842a-90886c357fdd", "value": "49152:NUWncMLitEUJemXV1Lk9pfsa8iwN0bc/BlGeXeLbA:NUcLmEUecGfspJp/BlGi8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672878, "uuid": "5660f98c-9125-4d27-a669-e5fb1053965b", "value": 2441463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672878, "uuid": "7a769118-1899-432b-8782-c4b8b4ced595", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672878, "uuid": "0f3910ac-8d76-48db-8483-0d4530de34f8", "value": "Chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dbd60c-e19c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672364, "uuid": "15de5df5-9c9d-47b3-bde2-eb5eccd14e42", "comment": "Malware payload", "value": "123b3bd746f1c889826a443143d1f004", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672364, "uuid": "bd490f17-7253-44f8-8dcb-8f0fe928e82e", "comment": "Malware payload", "value": "47d402d737a9c4af4260926157f8dfc66066f5becbff74885ec586e4cd0ae773", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672364, "uuid": "d2c0d74f-4ca1-4db5-9d1b-70df4711a831", "comment": "Malware payload", "value": "69dbf7c234404dab3689c419f42009d8f58ca61a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672364, "uuid": "0a94d040-c1fe-4a82-926e-94301d7fabb3", "comment": "Malware payload", "value": "bbf6924bafde943eacb4464fa32ce1ff85f7b6476f60d6b3c4a1c39673fa55081efbecd7f63f2114202fd9f15c386ff0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672364, "uuid": "4321533f-ce8d-47fc-b543-7d8acbe002de", "value": "T15073CE24CABF10B9DEC9FF7F5193E6612B11625B2E606D343FF0A38A1DB5520842C94E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672364, "uuid": "5df261ed-980f-46ac-8c0a-d3b4dded4da8", "value": "1536:jyYzOWSdvltxlqhd9JsauHM4iisVauAIvTsJLMF4Es:HSWSBLxyrJWMBJvwJIFHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672364, "uuid": "a14bdb2b-6b69-44d2-8b5d-25d4f1dbc869", "value": 79832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672364, "uuid": "2fa9cb0b-6f73-42aa-be40-b2879edd2d2f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672364, "uuid": "9800fbd8-b770-479e-9ce2-ffe08d0f85e2", "value": "accusa.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc5db83-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626074, "uuid": "a3103846-49d5-45e8-8167-7228d1f6a44c", "comment": "Malware payload (Mirai)", "value": "e541175e77b1f96e90324a96651d0368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626074, "uuid": "17b0f353-a4a5-44b7-ab87-f4f43f06ac6a", "comment": "Malware payload (Mirai)", "value": "4818a495709fc6cc5a81b295e8fc82fd45799f29e6d1b3d225f80d28f49a64a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626074, "uuid": "f40646e7-07aa-4c95-a7d3-23265f2abcfc", "comment": "Malware payload (Mirai)", "value": "ea735d7596d4cf478bb239f3e6185148dfc695df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626074, "uuid": "18f1a2a9-65ae-46d5-ad82-f9033dc42ae1", "comment": "Malware payload (Mirai)", "value": "87bc11e762cba3338775d615e73a30602bca839bfe80ec53439806b3269862dc5206629655823b03f9e1f573077ac563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626074, "uuid": "989afafe-daf1-481d-ac02-4edefade1140", "value": "T13982D1B09398DC90D4B49C71E53D8A8275A753FDC0F830661009075CFA93ABBBB69AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626074, "uuid": "ec2bbf15-d135-42a0-9061-1d6db873a190", "value": "192:g15fEyQZR/pxwQXIzAC1/JTIxhOoOVJsFq3FIWihhNw/mdGUFR9CpZ9eHHqEEhIB:a5fED/jUZtJShhPhhymdGUop5hIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626074, "uuid": "07b5d189-cb40-43ae-b908-d19afa367887", "value": 17660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626074, "uuid": "0d6feacd-d978-48df-80bf-b16b6a72f56a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626074, "uuid": "b809d225-b4ca-48ae-b1bd-250c77b2da1e", "value": "0.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4771487-e153-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766641007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641007, "uuid": "df4e5747-dc7e-4105-afab-b96ea19490e4", "comment": "Malware payload (RemcosRAT)", "value": "d1d84bc62e9bf8e09e6a836e94028f7e", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641007, "uuid": "a662896e-4771-4972-ba20-f13db2bcc560", "comment": "Malware payload (RemcosRAT)", "value": "481fc14c21934b7f35d3e143c32ab39cc241b4300677431246b7c1dca10f2258", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641007, "uuid": "9c030e3e-e048-4306-bb1a-34660392cd34", "comment": "Malware payload (RemcosRAT)", "value": "1575b8a0c90fc13c3d611a87f0a2e155789dec82", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641007, "uuid": "434ecd0a-32e2-40b5-bf32-5a75a6f5048c", "comment": "Malware payload (RemcosRAT)", "value": "3de475a5f92fe4c7c9d8765cc37d5d7aed75ce33a669032c57c1b15dcf0d7081231506ee93f9c666c0424a86da2eb97c", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641007, "uuid": "181dd550-0c06-4a71-a996-b49b872b2053", "value": "T14F87335212B6164EFE35C33904C88CAAB7158EF8765EB5C4370211A45ECFB702BAAF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641007, "uuid": "a5ff9c30-99b7-4688-b3be-91a2dd329d39", "value": "786432:2Ks4JEZmNE9n39v/K2W4/gYJ2oiN6WnNCbmmeRx0ADhwyjNRuWzcrBK3:2KlM19n39fWOLgdN6WYbmjn0ghwIoWzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641007, "uuid": "7a38092d-02e0-41db-bb66-ecc5c88ab3dd", "value": 38693211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641007, "uuid": "aa0c26cd-ce9f-4a7c-b992-644a54a244a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641007, "uuid": "d00e2cb2-2e88-498b-b244-41b89a153afa", "value": "30639302421669221611369529553.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5cae85-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766665612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665612, "uuid": "33febfbc-dd07-4268-b385-8c08392d0105", "comment": "Malware payload", "value": "6a1bf2c5babd402f37c6f250d3fb9971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665612, "uuid": "4bea5222-ed3a-4ba1-8e85-541bb0e95456", "comment": "Malware payload", "value": "485a1d42ca44e8c524f23dbf3fb1c06378340caf2100a45e69ba86144e7a3d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665612, "uuid": "80501d59-5ac7-4aeb-ac7b-d4f6655e3f6d", "comment": "Malware payload", "value": "923c688afab1185286508a90015277f51935fc0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665612, "uuid": "8cc60151-71cf-4c04-82b3-b8a9943646dd", "comment": "Malware payload", "value": "e8cb69c96867c70fde263496d9158d5bf9ca576d33e4ebf427302768499fcccd494d5f7c4f1981cb721d56126d00331a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665612, "uuid": "85e54f60-c93e-4450-87e7-b612e7a8b372", "value": "T1B8531B1BB35364ECC62AD57486EFAB33B671F8634630AF3F02E4E6702E11E601E5A515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665612, "uuid": "3af13398-aec4-4426-9388-09f1dd1fbd80", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665612, "uuid": "7d7c71c2-43fa-4664-b1e8-a6c32ee68ea1", "value": "768:ccGovCAeG58oao/JVTM5y0VQu0hseQzRxUMUla8vX6puvf1bWSPDV0gOiATWhea:NGoyzo9onqrqcvlP6EvfBZ0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665612, "uuid": "25f92943-86d2-4896-be4b-7d836bdff1d7", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665612, "uuid": "1d6b3d27-1d1d-41f1-97e7-67464b1410ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665612, "uuid": "b7a72585-dc3b-4f69-8de5-38468145ad31", "value": "cbot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf30009-e15f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766646225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646225, "uuid": "0566381c-77e5-405a-a831-54dfe950485d", "comment": "Malware payload (Mirai)", "value": "402f236915956d39ad71784425be2fc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646225, "uuid": "6b9b9541-7063-408b-ac6e-efba73b586f4", "comment": "Malware payload (Mirai)", "value": "48c06e4a16e0b1423af6c9e0e9041104dc7fe74867d5ca22bf0c9f456a6c06bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646225, "uuid": "dd04f8f5-5dd3-4888-bbc1-f3cc844cffde", "comment": "Malware payload (Mirai)", "value": "e8a77614864de512e8e2c76fa1099cdd10a6e5ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646225, "uuid": "513d72e7-1922-46c7-9302-e324fdb15825", "comment": "Malware payload (Mirai)", "value": "37b5d761247f9c315ecfd7c6af6583afcecc010e77f0f623dfee007e0106c3e0841271f5870a4f055feb3793f0eeef2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646225, "uuid": "47ba9a88-313a-4f50-9395-e91590960ca8", "value": "T10104F842EA43DFB3E55310F202B787310E71E97A6C66D542E3BCBCB4A9615D1A60A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646225, "uuid": "53045e59-13f5-4908-b425-ce0a8f107503", "value": "3072:nfmM6+jg5eOESSvk4sOmdc6AIFX3PElOxi32KpzyPN7GE/BlpGe:nxA5eOBLgIFhA32OuFT/xGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766646225, "uuid": "7b0df199-c89d-487b-b222-25eb59f4ab01", "value": 188900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766646225, "uuid": "0db205f8-16e0-4470-b2cf-45322bfd9bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646225, "uuid": "faeec280-a639-4941-b215-4261c467e28b", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3b7017-e1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766707132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707132, "uuid": "b1bc5644-2e39-4deb-a7d5-6551a2fafecc", "comment": "Malware payload (Mirai)", "value": "b0a20ece9707b66873cc61576ca9c5e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707132, "uuid": "fe3a0525-9bd6-45ef-83ad-6ceab62b2aa9", "comment": "Malware payload (Mirai)", "value": "4a55540ceee9406ffaa7e07bcd03c45d2e81be6a08dd413543385c69e6080676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707132, "uuid": "99b30185-5cbe-441e-adca-310553b05578", "comment": "Malware payload (Mirai)", "value": "d02e011fd41154ca94bf68aa3bbaf5168d72b951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707132, "uuid": "90c82d4c-8a9d-403b-8627-021d46553492", "comment": "Malware payload (Mirai)", "value": "a601ad7fb85c431ca2cc15dd0d6f34ac564a82caac99bf9bf35e291dd5033cefde7177119ac28f2eda899bd34b1123a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707132, "uuid": "c76cf458-951a-4546-9ede-068617576a05", "value": "T16C836D42B3184A43D99709B0393F27E183BF995025E4B78A650FAF9A4676E33144BFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707132, "uuid": "5c19ed82-350f-49a4-a665-bff8b8545531", "value": "1536:hTGNrVFtOEjs3df+K3yBO9+wBsqWbMkT2bVRI:hWeNf+i9VpGT2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766707132, "uuid": "17509959-80ff-4b3b-a197-cd6d9b680cea", "value": 81220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766707132, "uuid": "8b05f68e-ffc3-4d63-a611-a32705878425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707132, "uuid": "d63fdf4e-ce0b-4c83-b53b-eca9208d45bd", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0273e648-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665190, "uuid": "583d16e1-a8a4-422c-b728-9c52b52fbb1c", "comment": "Malware payload (Mirai)", "value": "31308a240e85f3c7d3b7128319dbd6e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665190, "uuid": "0b98ab9b-c41f-4505-af4e-e67ede2180aa", "comment": "Malware payload (Mirai)", "value": "4ae2062b256fbbc5fb44ce225b489098393f91de7fe45d67722820e0e5237ee1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665190, "uuid": "9208f54a-2014-4fe9-82d0-126c18198c45", "comment": "Malware payload (Mirai)", "value": "220c75d51be696a4abf4ca1a9343b334d3aac147", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665190, "uuid": "65283cd5-1b8c-404e-b67c-8ce7dead193b", "comment": "Malware payload (Mirai)", "value": "2b396f816e96504719b483754c7fcb20bf717b8cff009dffb5082932e882bcef99321147b09a8816102fd2b289d9cac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665190, "uuid": "382ba851-be44-473c-a1c4-d8fc942c147f", "value": "T104A3D60A7FA09FF7E89FCC774AE65705208DA41A21987B367934E918B70B64F14E3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665190, "uuid": "90a0e54f-0a43-451b-a084-f822a9e3bcc0", "value": "3072:GMnt+196DwukNzo4Y/rLrbZSR2P+zac4eYG/SDQRNWXM/JP:GMnt+196MukNzo4ErLrbZSR2P+zac4eT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665190, "uuid": "99d57198-67e3-4668-82bd-a2b18b7c3f3f", "value": 104211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665190, "uuid": "61d6bde0-20c0-4ae5-b97e-3fdf7179be03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665190, "uuid": "07039311-f6ea-46ee-9333-f7812986d498", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0c5b27-e1c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766691462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691462, "uuid": "3c63ea49-b2c7-44e6-b058-ca23aeafb254", "comment": "Malware payload (Stealc)", "value": "50fc6559127c76fc8112f9dab70f1b8f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691462, "uuid": "02d3d573-4b1c-409c-a9e5-115b472e883e", "comment": "Malware payload (Stealc)", "value": "4b1b9e1ed0efa52e4663f9247477c273166481fdd8e639cae35c4909de3566d9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691462, "uuid": "3a059043-098f-41f5-87ec-a8fc84accf34", "comment": "Malware payload (Stealc)", "value": "ada27ed2eed21562667ce9c4c8ca3712d2c194c7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691462, "uuid": "290bc837-8c62-4e37-a562-97301d70d4da", "comment": "Malware payload (Stealc)", "value": "89e53266bcf32ab2534d28fe69ebb19c62f8b4e9de4cc16919cd5bd2d8f62197462655656b2b1a2f428faddd93955e30", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691462, "uuid": "5fa741d4-4d6c-4d65-9ae9-4ba2c39bc455", "value": "T1F74423B27935EB09FA0696F9951858601E7E9645F5EC0786F8CD09D2342BEFB09FC803", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691462, "uuid": "4e10c7db-11ee-4ce8-b060-01626477fcaa", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691462, "uuid": "bc8a3eef-21be-4d33-b8be-8e762df7d34a", "value": "6144:btukz/YgxzvmnZhonKIVQW8AulLqoS1QHNu6A+UX8zOrL:5uLgteZhUKIVQW8ARoS1QxHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691462, "uuid": "7ef50f15-f90f-47b7-b5fe-9387e9398c07", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691462, "uuid": "382352c6-443e-4848-b4fb-e665a29a9a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691462, "uuid": "f8b53d74-cc04-42c8-9f13-f5979ed1690a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b095d48-e19b-11f0-a129-42010a9c0007", "comment": "Malware payload (AuraStealer)", "timestamp": 1766671808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766671808, "uuid": "1f5a0c27-92fe-406f-accc-a0127586b95d", "comment": "Malware payload (AuraStealer)", "value": "879e77a29d0ed7f760a3f2ed83f87779", "object_relation": "md5", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766671808, "uuid": "d3c71c36-4f84-486a-b6e5-3acc0e355b97", "comment": "Malware payload (AuraStealer)", "value": "4c01725c8366f6efe1deeb4f7a718c1b0dca7e200c1a4fe8b12a2a52e234aeb1", "object_relation": "sha256", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766671808, "uuid": "31a23207-d5c7-4398-8286-a9ecae97b003", "comment": "Malware payload (AuraStealer)", "value": "7bd52231171e19cbeda295fcef15f0a0adf1f14b", "object_relation": "sha1", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766671808, "uuid": "fc0a625e-4026-4452-892e-c4749a76d5e3", "comment": "Malware payload (AuraStealer)", "value": "1afd5e96f8e19e3a4950cc42cad8a3fd0ee5d045f0829ce339e531f7b1bbe0a76d0694ba4a12475560f83baf56e4d37b", "object_relation": "sha3-384", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766671808, "uuid": "8533b6e7-1cc3-4214-b1b4-cbdc8ac2b07e", "value": "T1AFE3F92676E4A0B6E4B5137889F6825356317CA05F7692FF32C4B7BD1E326C1A431B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766671808, "uuid": "4244a92d-6d43-4827-bb6f-2397171f93f1", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766671808, "uuid": "a77d6a32-c77b-498e-9f36-3f1e0ea7069a", "value": "1536:irae78zjORCDGwfdCSog01313zIs5gvhJh5tyhQYliY5h:KahKyd2n31Dh5nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766671808, "uuid": "eeea82d5-8a57-447b-b4c5-802e4f86291a", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766671808, "uuid": "1180ea9b-42ec-4157-9cc1-7c4016c208f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766671808, "uuid": "560e4d35-6009-4b11-8177-8515fbf88fc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22c7025-e1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766704193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704193, "uuid": "c767ab2f-2cdd-4d77-b18f-1556b1ef374d", "comment": "Malware payload (Gafgyt)", "value": "496a7009225ed6c23b50036d6c99186d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704193, "uuid": "9c3adcc9-b94c-40d6-a8b9-e455d2145736", "comment": "Malware payload (Gafgyt)", "value": "4c58eea1bbdf0146c99bc6f43f78df69da75edb2d313e91ac93ad7f0415dc22d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704193, "uuid": "548dcb61-1be1-4372-9871-b1ac80cb6197", "comment": "Malware payload (Gafgyt)", "value": "637d5311169e4b4bb77b243054fec5d1e6e3cf90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704193, "uuid": "984ffba5-9123-49e6-af62-6bf40f86e959", "comment": "Malware payload (Gafgyt)", "value": "d200e16a6cbde97d9699df5a24f5214a4fe34869471e41d93ce144aaa662ddd9de1caa6dedf3975104067712d50b644c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704193, "uuid": "9c12f972-fdc8-46ac-9b2c-a5b557ca20c1", "value": "T1F7E2E131EB466DF3FAE10CB73A6AC10553A67578ED0335BAAC1A5378E4C30425B7588A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704193, "uuid": "365649dc-14b9-406d-8223-27451345b305", "value": "768:8QCEJ3Eda5gR/GVbBxkIsWdR9tZ8q1IvmRewPSyI3UQ:8QCGEE5EsbD9LfIno4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766704193, "uuid": "cbc11bac-70ab-42f2-a10d-0fc929c154bd", "value": 31760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766704193, "uuid": "eeeb69ab-2649-40a7-8d2d-c9c08cb8c2ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704193, "uuid": "bdd633ad-7ae2-4ad2-98b7-4dd050bcde78", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac8b876-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690866, "uuid": "d5e015b4-9c3c-4567-8139-2836cb6f6ba4", "comment": "Malware payload (Mirai)", "value": "01bce913f42b0f68ffe1d30183edb3d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690866, "uuid": "775d777e-e64b-4faf-b251-ca8afac5dcb4", "comment": "Malware payload (Mirai)", "value": "4c68a0f7779dafedfaba3bccc6b9332e20dc305a7242b134f10e59efdc390a84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690866, "uuid": "466f8069-0ea1-4882-8e9e-c64924675c7a", "comment": "Malware payload (Mirai)", "value": "dd1ad8ead370c67d23e095f27637d060b6664c37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690866, "uuid": "76043618-a74b-458e-9b07-76255d47a8da", "comment": "Malware payload (Mirai)", "value": "902630418a8a40761fbbbc5892fe77fe372171f379a2108eff1b53e76b681350528ae04f4049bc5219bb827d5f932886", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690866, "uuid": "3b5966eb-bd9a-43b6-8ab4-cdb9a1fb8d0b", "value": "T1CC41E3591FD01E32DD66CC36455A2B5129CC841F616A23925274D960BD2EA04A7D38E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690866, "uuid": "968897ae-58e9-41c2-9145-1bd2914725c7", "value": "48:UQ2MnuDS3E6df9H+SMTLWPkeTwWDYFCXp:UQNnuu3f9eSoLW7Tw2v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690866, "uuid": "ce269f67-c946-409a-9641-c389d226d017", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690866, "uuid": "75f3ede1-c50a-4054-8321-db4a43789b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690866, "uuid": "a9d6f56a-6781-4eca-b420-888e7a328974", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cd024b-e18d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766665685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665685, "uuid": "adc7f1e8-9c6f-4e60-b052-5536c147268b", "comment": "Malware payload", "value": "336cff515b149a8816ee50dbbd465d83", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665685, "uuid": "f9982134-875a-419d-9ef2-21c0dcd60d29", "comment": "Malware payload", "value": "4d0db806ed1ba6f9ec11872486a646c56bf3de33c8ad21581071c9d0962721f7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665685, "uuid": "9c446a84-54d9-4864-93b4-a7cfe9a94f26", "comment": "Malware payload", "value": "fe0d8aedb7831a9354c9755c867f9f4b4c3a5b85", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665685, "uuid": "0848224a-bf94-4bbf-9032-a5d068d8636f", "comment": "Malware payload", "value": "2a889903abffb048efbcca86c060be3f69dfc1759ec0cc24eee861b12989aeaa0106243a873f80dc110c5df64de59a18", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665685, "uuid": "85179e8d-4df4-44bd-a3a5-3356dd19e7ec", "value": "T1B5187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665685, "uuid": "5e064b6c-bdb9-47f8-b204-8df42509e7bc", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665685, "uuid": "416b004b-5b6c-4197-aba0-7d47ef02377d", "value": "786432:UAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:UAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665685, "uuid": "33a3b6d4-6d62-49bf-9adb-2b894d56344a", "value": 90425344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665685, "uuid": "4231f005-213e-4c72-af5b-2d759068de56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665685, "uuid": "83660213-3c35-40de-9617-bd305e6aeb24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23087de-e193-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766668491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668491, "uuid": "63ecc8d6-9ba6-439b-af9e-60610ef31b10", "comment": "Malware payload (Mirai)", "value": "2be57aa7bc85e89f1115bc0f345033e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668491, "uuid": "51e2a976-a8a5-4c8d-9021-4e3709339e51", "comment": "Malware payload (Mirai)", "value": "4d96817f3153887e1639ecc657a0ff92463682c08c200477cafcbffa34fbe9d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668491, "uuid": "4aec9373-e806-4e1a-ba15-bfc2e8c1f7ec", "comment": "Malware payload (Mirai)", "value": "0e246f23c5af133394eb91f4aca8d95e485177a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668491, "uuid": "fa1730a1-0fb7-40b3-9775-4460e2462009", "comment": "Malware payload (Mirai)", "value": "407be0ab6e25c5d40ba32ba7a0669254852be326c07d25985946442ec60e188bba63a3c6ae31ab2e858e341a03069863", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668491, "uuid": "9bb90be3-b3bf-4bdd-896e-4c9346a157c3", "value": "T158C3C70E6E219F7CFBA8C23447F78E21925833D626E1D685D15CEA015E7074E742FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668491, "uuid": "110a888b-6dc5-4518-a59c-b5335abe9dc6", "value": "3072:VR4d3JZrNKG93eo/RTKykKNVwTpby+1zLC0ONoS:u3JZrNKGteoJdVkbH1Lq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766668491, "uuid": "ae7d69ba-69e2-4ed7-a8b5-349459b55cf8", "value": 121816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766668491, "uuid": "03e518a3-a6e6-4700-a643-d2828a936be9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668491, "uuid": "812b99fd-5b7a-4d84-a90a-8e1da57d88fa", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90c4835-e1c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766687857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687857, "uuid": "40190412-75e4-4dea-b1f1-788f9763773f", "comment": "Malware payload (Mirai)", "value": "997aeecfe487d0cceaf523eaec36b530", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687857, "uuid": "d76c1cda-0a9c-49cb-84cc-8095f258ed91", "comment": "Malware payload (Mirai)", "value": "4dbc07d35fd148dae86f9bde4b36e61b981f5cb0a2e3cbb85f4d1174bac3c24d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687857, "uuid": "66c4dafd-81e6-43f8-8e87-e965369c09bb", "comment": "Malware payload (Mirai)", "value": "9e294cec5f1605355974a6f888b6e3e8d5678e67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687857, "uuid": "e88acfe6-76bc-4194-b105-7d33d15bbd06", "comment": "Malware payload (Mirai)", "value": "c51fbdc0373bfccbc4b8b7488a6366c1e687a0c896e4ff62827e96aa44904b505884f6b63454a6b9d52c138ecb9d7aa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687857, "uuid": "583a7ff7-6407-4c4d-8ba0-23fbbd824e79", "value": "T101736BC5A603E8F4EC1606716137F7365B77F43E1028DA87C3A9AA37AC52A41E50739E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687857, "uuid": "929e34cc-b08d-4ce2-bf8d-35978dc125de", "value": "1536:USRhOh1WwEUc/dkYn2HzyXdRfK5RswqXs6UFmg6NHxV6k3cIwQhNmt:bOfXEUc/dkYn2+XdRO6zJUFmg8xVvMR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766687857, "uuid": "ef7c668f-51b1-4443-a1fb-5d62ac19c112", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766687857, "uuid": "0627a95c-586a-4e42-9763-ff70e038c669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687857, "uuid": "57372f3c-94c7-4e23-92ff-f36139c7744f", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169479aa-e12d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624421, "uuid": "dab90208-5b33-43bc-ad9f-bbbff7efcb9d", "comment": "Malware payload (Mirai)", "value": "c7bbe36add240f4db4b7d01d08250258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624421, "uuid": "97489650-6d80-42ab-8017-4d8be53258c2", "comment": "Malware payload (Mirai)", "value": "4ea5ce969c33af4debe37f1a8018662e59f52aa011827fd05a7fd15433c18d83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624421, "uuid": "206e9d00-b589-4047-a0b0-edc3ecb24f50", "comment": "Malware payload (Mirai)", "value": "4946e756aa99e3eb0feef8bffc67ede0aac8cd10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624421, "uuid": "22b9d34e-01b6-4593-9696-dbd898c4ce4a", "comment": "Malware payload (Mirai)", "value": "b2d243a175f2058d36517824849b277bcb100d2ef9d8cdc89040d5a37a87b557c09051e7d7eced5790c9b166d1e1ecb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624421, "uuid": "2e611c5e-e0ab-48c6-9990-b705bc9febd6", "value": "T151237D36C83E6D94C4598271F530CA385B13F505D6872FFB6E9689A08083EACFA593F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624421, "uuid": "35899de9-3a5b-4692-8092-a7b7945c38be", "value": "768:1ahSJA2RyoPx+degh+xT1GHItt3/37OJoqYjU5C3lonywCOyT:1ahSJtPAdGIHUf7OqdU51ywCOyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624421, "uuid": "448ef432-44af-4b7e-851e-d72ec93089ab", "value": 46316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624421, "uuid": "c42fb37d-19d0-4623-b604-75470906361a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624421, "uuid": "068ca0ec-2282-49c5-b1c4-fa019b17bbd6", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f0f1de-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665197, "uuid": "a5ec1d7a-9ddb-49da-bf67-4049e247429f", "comment": "Malware payload (Mirai)", "value": "d911420131f4cf0f02e9ebfbbc26e469", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665197, "uuid": "85d61957-d017-4013-96cf-5f83984cba99", "comment": "Malware payload (Mirai)", "value": "4edebf770692c4e57ff3e5233af85da4d1ca3ad8ec65ca861aee32d7bbbd4321", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665197, "uuid": "ced4e80e-619f-4a18-a359-568e11ec6e59", "comment": "Malware payload (Mirai)", "value": "21fe341af1f53ae0fefe90c5a5356596c91ec11f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665197, "uuid": "f07b414f-ea77-4c11-9f53-c9d1decd9874", "comment": "Malware payload (Mirai)", "value": "45048dbd176cd7432bc2404d1fde5563b511f6ea6913ca4c993a9ef3752e8bfabfaeb2d4402f12ddd647c1c3bd81e182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665197, "uuid": "c5705bc3-1aeb-4c1f-b628-bbc393a04a9b", "value": "T1BCE44B56F8809F62C5D12576F65F82B8731347B8C3EB720689199B383BD782F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665197, "uuid": "0e0b9187-6ebc-49f6-9df6-ad0f25cfc168", "value": "12288:o4Vv4cd7yDwDRbxjHhlstLq0AawMU/h3JgpIor7YDRn60TARJcli++:os4cJy03ktLDAaSo/l0TAncli+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665197, "uuid": "47f8451c-a9f6-4448-a173-e3e1ad92b1f3", "value": 714580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665197, "uuid": "2a3769ce-cd74-46f8-9b29-60d3fcefa0db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665197, "uuid": "e4e97524-64f5-4408-aad2-abc292b84600", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b605e71-e158-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766642924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642924, "uuid": "c9a2d1b8-3ad0-4192-8021-06bd17252b9c", "comment": "Malware payload (Mirai)", "value": "dfebe41936d03efe5432b1411fac1f3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642924, "uuid": "36882b6f-c73b-4467-bc12-d0db0a4bfc8a", "comment": "Malware payload (Mirai)", "value": "4ee35e0c4d0f39109f8222d0e055e2b364e1aaa10dcf688caac680fdc6fccdc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642924, "uuid": "09e21f6f-2194-4064-b9b3-d23a3f37ec3e", "comment": "Malware payload (Mirai)", "value": "9b30c43459934eb773a7d882fe72c97fce12b177", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642924, "uuid": "87ca5e5e-3ae9-4d0c-aff3-839b92771d85", "comment": "Malware payload (Mirai)", "value": "3f5f17e51cf73175af89188779af6f62de38252f3db7be5e639b3fed9abf790357263b915033c52348b0ff10446a4695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642924, "uuid": "0e10726d-dca4-407e-b318-bd643b1896ae", "value": "T1E8143B45B643CEF3E45304F111B3963E0B31ED394826D595EBA8BEB4DA33AC166163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642924, "uuid": "38b8bca8-50f0-4af3-8e17-5d82feaa7497", "value": "3072:7UoWnXfE229aqu2Zhs6LF5hAh60a6q1U9C18lpzi:7XWPTCaQhDUMUC1Szi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766642924, "uuid": "1c1a2e7b-001e-41a8-a22d-ab5fcc23ebaa", "value": 192996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766642924, "uuid": "f1f46b09-fe75-4e94-89ce-07af50918b4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642924, "uuid": "e8b4ee81-5478-4973-8b60-b7a3025bca5e", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716c6050-e195-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766669241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669241, "uuid": "01a7e786-39c0-4ff6-a995-ee6a3d77c4b7", "comment": "Malware payload", "value": "3fc17551206f6470d1b1987fa6c2cc03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669241, "uuid": "30c5be08-5147-4fa3-8f3b-32efc1ad6438", "comment": "Malware payload", "value": "4ff3e78e193c39eb224d13d0108e773632a25ef1d649b3bd3b674ffcd5752049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669241, "uuid": "a4f30603-65d5-4bc7-956e-6f9db31de471", "comment": "Malware payload", "value": "2ada16387a76797f0a6cd4656c25ce87f642d180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669241, "uuid": "45dd4bc7-c694-46b0-a396-c8b49093fe7b", "comment": "Malware payload", "value": "21bf90fd9d2780a2516343c340cfe0c029667f4e279c2e8d74ab5525da472cec4fc2db58a5ef56f0a4a6069114575aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669241, "uuid": "15ea8d37-1cb2-451b-97df-4a72d992f687", "value": "T193086A4267EA05C4F9F7EA3589E65217D673BC166F3085CF224C072A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669241, "uuid": "5de86b55-0987-4a5c-9c12-c06587e53530", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669241, "uuid": "4d45bb76-70b8-43ae-9578-e39e57981eeb", "value": "393216:QIFqKb+iUHdZQKPAg9hAJLPU689cN0DshEQu58EASEhoIaE2lShUcBs4DJ7G15P8:QndQmQJhnVn0vSa5rs3wbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766669241, "uuid": "6f2593a0-2702-4a05-abc9-f327c70cfb49", "value": 78127019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766669241, "uuid": "9beaf3be-ff80-4204-90e3-b9a8444d4cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669241, "uuid": "e29bbeb9-4a00-47b1-8d85-8407733afd6d", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53ea646-e187-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766663315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663315, "uuid": "1818e383-8ae4-42c3-bbcb-04679802848f", "comment": "Malware payload (AdaptixC2)", "value": "bbfdb7f47559bfde4090b7c113c9d274", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663315, "uuid": "61ad84e4-eb4d-48b7-bebc-39d729b86fd2", "comment": "Malware payload (AdaptixC2)", "value": "500896fbd343a7c713ddce1815d9827606edae3f81abf0fba68cb6b163ce0871", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663315, "uuid": "c2627a7d-9685-4cb6-868b-5de984991c3d", "comment": "Malware payload (AdaptixC2)", "value": "fc2b662059366f8a4ee1ed54f71940e44a3c3c6e", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663315, "uuid": "0d96929c-c259-4aea-b01d-6fc65848ad18", "comment": "Malware payload (AdaptixC2)", "value": "5ddd446b561882abd2c74eb66b20d5299e1b9c5fe7708f09c7e48af49bbaa7c7255afaed310d0859ab446bcb5684602a", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663315, "uuid": "2c841411-8ad0-4c53-ba80-856c6069f18d", "value": "T1AA836536E6B3C4ADC06FD534AF43A4B2B9F17C184534661947C5A6223B6BD386BBE240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663315, "uuid": "47957b31-c65b-443f-99dd-3f2db8fda431", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663315, "uuid": "9340632c-66df-4d17-9bd9-8922a70812e4", "value": "1536:dnWbxuoR8qrb9sW2xIiWXuCs33xa805rVg5YFrOvJA4pqXvRpKa:4vRCZX6lF6m4IXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766663315, "uuid": "e3a2f474-22b0-4ab3-bb63-666e960cfcf0", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766663315, "uuid": "daf0d8bf-10e2-4057-b199-3984c6d88ac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663315, "uuid": "740d1960-6641-4c76-a071-84ee0f77d53a", "value": "bbfdb7f47559bfde4090b7c113c9d274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5e8970-e1bc-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1766685908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685908, "uuid": "755e3822-e867-44fd-897e-d55a7fc453e6", "comment": "Malware payload (njrat)", "value": "11e30f8c22f0582b5a529d6e3e7294c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685908, "uuid": "42fbc2dd-4150-40c0-a77d-e3a681239d3a", "comment": "Malware payload (njrat)", "value": "5036f6ed4ef84a20ece8e126eacb438ce082b345c68fc3286608f050cf8b896f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685908, "uuid": "3787e3ee-2aec-4b06-9027-9b97bb2a79ab", "comment": "Malware payload (njrat)", "value": "4adf523c428b27771468484ba3654e75e05f0f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685908, "uuid": "d132125c-2797-4f4f-b179-27a6ee4a54ac", "comment": "Malware payload (njrat)", "value": "d0a494bc90a084d66ad9799c75be49179a690cc714dd0092b9b24b19bc5bc06f1576b5834cbc29be83b22f11cc2f22ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685908, "uuid": "4036f117-b53a-4b29-aa8b-ba01343b0997", "value": "T1D9D4D00173408691D296BA7BC2FBA4B967B13D832556C75E6EC4B3DC6C33363BA0661C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685908, "uuid": "1a5bdc48-825d-470a-9825-b584c74b936b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685908, "uuid": "1cc44eab-e927-436e-90d5-a2c0179b99b0", "value": "12288:MBK+Q4K+Q4K+QdK+Q4K+Q4K+QNwzznsSXAveuJwwFkOuHuG+r:PptptpIptptpQmekuHuG+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766685908, "uuid": "e2506dec-e7b8-4404-ae39-4d8dbd446ea8", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766685908, "uuid": "e8912d14-db40-426b-b501-effb8099e5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685908, "uuid": "ac06ae52-d7d1-4710-a6f7-1e7f62b11b3f", "value": "11e30f8c22f0582b5a529d6e3e7294c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c712eb-e12e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766625220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625220, "uuid": "c81b067b-c42d-471f-b596-947be6b26ac1", "comment": "Malware payload (Mirai)", "value": "101c5156c5782c3e6acd8ade1127191d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625220, "uuid": "e2470596-3add-4b5d-893b-5d8646715c63", "comment": "Malware payload (Mirai)", "value": "50a98052102d3f8eb3625d6db92fd68c6bf0f1b7a805a454eac8b6b00218b8dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625220, "uuid": "b0cdb973-ffad-4085-85b2-b81926fbb7a8", "comment": "Malware payload (Mirai)", "value": "b80940d8104f09993bfbaa476397b8fe6cdfc490", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625220, "uuid": "3414ac0d-b3db-4812-be03-780f94afdac7", "comment": "Malware payload (Mirai)", "value": "b57a518f6ab9673a74abf92975197fe54d81765cbb41ea7032e02a2b46173e20ca8857768e748a1a16d6f8f36cd8f577", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625220, "uuid": "adbb167e-64d1-4204-9ec1-e181adddadcb", "value": "T1F963F896F9919B11D6C162BAFE0F518D331307ACE3EF73139A146B24678B46B0E7B805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625220, "uuid": "c50181fb-114e-4389-8d1c-9ed84c38e302", "value": "1536:jNnAnfq0kmQ8Lc983ZnjJY3x3XMtiDZ3CuY2nL7VXYWTw:yniV8Lc983ZndWZ3CuY2nLhXdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766625220, "uuid": "92583997-3228-4f3d-a1af-a0cd790718a1", "value": 68068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766625220, "uuid": "014b8d37-8a61-424c-9b50-7614fe614fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625220, "uuid": "ab03739e-e743-4c33-bf66-28d1afe35bc5", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff4a798-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766694042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694042, "uuid": "5b55e088-9df0-450f-8f36-56cf6e1fea06", "comment": "Malware payload", "value": "5bdafbd03a62b7905a0ae1ed26277a7c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694042, "uuid": "594e879b-0801-4079-93da-44589c81f893", "comment": "Malware payload", "value": "50c063208801f6250ad0984212bbff667fa4b979b5443a639b24bc5bbdce0b5d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694042, "uuid": "8a00adde-a2ee-4847-bd52-e725d9cd76e3", "comment": "Malware payload", "value": "c93b359f35d7a26b78a68ef7ddcd81c79b863ff3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694042, "uuid": "dd6838be-a812-4bfe-a19f-9e9e30a6d140", "comment": "Malware payload", "value": "2682038156b6888e6b0c4f6342c060f48b737e91053a00236d8725cb38e55c90621124b85d2e37119705daea28408f80", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694042, "uuid": "939c815b-42db-49a2-a212-6c78226043b0", "value": "T10592A50267DD472AF17743386DB307142676FE579EA283AE25D8121F6E22B100CA3FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694042, "uuid": "50a9ee47-eeba-4078-b826-6c72c90dbf38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694042, "uuid": "40afd29f-eb95-4f82-adb2-924f67e234ce", "value": "48:60bMG7ow3k5bkJV8bAPIk+DRiMOul5hSbqnvpfbNtm:7HoSKRRLbwCBzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694042, "uuid": "2e17c01e-3bc2-48dc-aa57-cccec74f1236", "value": 20000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694042, "uuid": "66f927ef-127a-483c-b8ca-1351cffb9915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694042, "uuid": "1ec3a943-ef5a-4e1b-94bb-9304d3395e78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30516418-e1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706928, "uuid": "efa6e768-38b7-48f1-8749-a7a9da976417", "comment": "Malware payload (Mirai)", "value": "c09727d4b17d67fdab099c4115472d82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706928, "uuid": "c6aaa0a9-a240-4364-af13-2e5d3c4497a1", "comment": "Malware payload (Mirai)", "value": "52f1b3257014d4e70d48c95706e57ea834187444e5967e8678d39ea3b50bac5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706928, "uuid": "f66a3dc8-f09b-428c-b486-2b1a5f4238ec", "comment": "Malware payload (Mirai)", "value": "ea18cfe07a57d4b6c27a04536af5ea6b010cd276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706928, "uuid": "b435abd6-8f34-45ab-ae1f-052941eb8074", "comment": "Malware payload (Mirai)", "value": "ea716e5470f79b14761d37957217b1f13dec5960487a9e16d459521eb9e6b9ae34292a0f1fd7325c46caf4dd725a7368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706928, "uuid": "ca192794-301f-40ab-bfe6-e8430ab53582", "value": "T1E893E996B8918B12C6D452BAFE1E51CD331317BCE2DF72539E146B247B8B42B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706928, "uuid": "c57bffda-31c9-4bd6-9835-1bdd4e89ff48", "value": "1536:BNndWBdC0LD00Pk9ZDC6mJrwRpqHG1DGCY7cFSRX4+YqGULW38SY3UFMEiUy/xuy:mqn02RI776cX4+TaRy/xudBxNVxrT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706928, "uuid": "c02488c1-3589-4adb-aae5-71466b8cb327", "value": 91660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706928, "uuid": "9701671c-e559-4af4-8db9-2047d4669ad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706928, "uuid": "a0dc207c-ffdf-435a-8891-024c0c4873af", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbd710a-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626067, "uuid": "d40e358c-001a-4214-acff-c2db9a077ebc", "comment": "Malware payload (Mirai)", "value": "578508cb30ba7333a47d5a70983d0280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626067, "uuid": "241d651d-ebdf-4657-b148-5101e832b35a", "comment": "Malware payload (Mirai)", "value": "538d21fd90de70ef80ae4984eaefd1cf44ba051f2b46e4a81f55b7d7c28940a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626067, "uuid": "069779f6-5f3f-4868-a0dd-14f0c65c4b17", "comment": "Malware payload (Mirai)", "value": "dddcb6596986444c8587bc8987d50262a9aad266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626067, "uuid": "dceb2370-294d-4697-bcd4-c04b934244e7", "comment": "Malware payload (Mirai)", "value": "97e283743c75f203fa4a5bf3cd5d6d4283aafc239a988621057b259e8da0644b74dfe055d27f9d4079ea49f1bc645f6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626067, "uuid": "6adbaf75-8e5c-4da0-a10c-cf97f33a25ac", "value": "T1F0237D35E41D9EA0C15A4174B0AD8F341F13F2C893632EFB1AE646B1A453978FA16FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626067, "uuid": "cacd681a-e2e7-4c40-b2ab-87393f943862", "value": "768:GagaFeYpietGeydtoLrkarUqf7ateqlbJ9PSyC1o5VeseCzKwP:Gan+sGFrC6qfW71Syl5heCzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626067, "uuid": "7ef3a17b-69f4-4150-8ad6-5af077b25841", "value": 47644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626067, "uuid": "482f4d6a-9d9d-4fbe-af6a-b1bcb4f0d2de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626067, "uuid": "75594dc7-2ecc-414b-9a12-61b5234057a0", "value": "0.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03511449-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665191, "uuid": "670cf906-e378-4c30-87de-9d9a96eeaf36", "comment": "Malware payload (Mirai)", "value": "6325762e4eae60d89cfbce255bdce147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665191, "uuid": "28bfa9a6-2e66-42d9-8d13-bee3942b4722", "comment": "Malware payload (Mirai)", "value": "5546109c76d0c0577137a9d773f42595d620be9248f1d8297385eeb6b383d006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665191, "uuid": "9c874cd8-94d2-4c01-9d22-fcc9e2d07a92", "comment": "Malware payload (Mirai)", "value": "5f4e51cb659cd14c0d7b8f6914c5173aa7c89008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665191, "uuid": "cc5534c9-a25c-4f59-baa0-5af04b35023c", "comment": "Malware payload (Mirai)", "value": "2bf5196ab3b746de8448ff886fa45022127727b55e7d2a5029ed36f0a8db1ccc5fc1afae92083fe9164dc3cfce0191ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665191, "uuid": "bb748b4d-bd9d-490b-b361-bfdfdc8ce869", "value": "T1A5434DD6B800DE7CF947EB7A80164A09FA35722154A30F27A267FD93AC720564C6FD4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665191, "uuid": "c8f5f482-53ff-4aa4-941e-9dea57127e1a", "value": "1536:Xqgor9Y1ismFANPMu5G4jsCktnSygjVQstg8c:FessANrGvLJuQqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665191, "uuid": "74716aca-0153-410f-bbfe-fc17498a265c", "value": 59716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665191, "uuid": "9f650048-aeee-4546-8d5e-40028b6760ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665191, "uuid": "d5645c87-c45a-49ab-b6f4-a3cfa630c836", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8067f15c-e191-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1766667548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667548, "uuid": "08aef1e3-164e-4810-af8d-ac729dc11feb", "comment": "Malware payload (LummaStealer)", "value": "27b437c50ea1dc18927c9dd175f1d40f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667548, "uuid": "0ad6f9d8-1539-4fdc-8c9b-e5160b4a0423", "comment": "Malware payload (LummaStealer)", "value": "55b3f55aebb932d892f2bc432c98413a0f81b5641b99911714bb3b413b834ce2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667548, "uuid": "be699529-bca1-4958-98d7-575e1927f973", "comment": "Malware payload (LummaStealer)", "value": "536dc8a75acf5abe65604aaeddcf3ad3ae976205", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667548, "uuid": "e3d99571-8141-4df6-b192-8250980ac802", "comment": "Malware payload (LummaStealer)", "value": "ed8c9ecfc5f74f3fcb5f6079b27be00185a31655c4968dee648d538abd117c27ac506d8655f2c720c5f764f5ffbfa779", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667548, "uuid": "e00bf2e5-f2aa-4214-ad12-e801dea5270b", "value": "T1F3C639D2FB285765D69FD27EE47152453230B089033529D7BB9907A6880BBC8173FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667548, "uuid": "bd8baa4d-1e97-4c45-84ab-6ee21565d5e8", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667548, "uuid": "53774dc1-9ae6-49f6-936a-492168e2e56d", "value": "49152:8f9Q3BVhIE/Q3veLG6yuPqr5q58PMnOFlVt6TbZdLDIACiRCFdY79y18bb0nIEve:8foivXsZ6HORYK9iE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766667548, "uuid": "b7847648-6341-4948-b590-0632dbd4e8fd", "value": 12588672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766667548, "uuid": "2141604a-7fb8-418a-a9db-5ede19bc9449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667548, "uuid": "26f9cc4f-7567-48d0-a192-4b5b691010ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca28b591-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690865, "uuid": "329439a5-b29d-4aad-a7af-a72f4a6a4816", "comment": "Malware payload (Mirai)", "value": "b7d4053462b5650db8ace8d73e11caf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690865, "uuid": "57b09bb0-1eb2-4f38-952c-3936f740c2de", "comment": "Malware payload (Mirai)", "value": "5627940b7893dc5e707e82fc32cb500d3a2ce9fe1aa62e34714cd74ee26fc683", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690865, "uuid": "ae573c9e-d5e5-462f-8608-2603afb321e4", "comment": "Malware payload (Mirai)", "value": "cf7f37bf4f7f597187a178f4b8f7889a9f8ed8ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690865, "uuid": "9a68b764-e67b-4d7d-b913-eda39ce25cca", "comment": "Malware payload (Mirai)", "value": "67dc14655f843a8387383f6af5d7e0f672a6b74abf367beee004b8b2c343734b76773fc9c4a80196cf2dff0097dbf901", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690865, "uuid": "f5ec39c8-6028-4d8c-9c52-faef8732c0fa", "value": "T170056C17F6B3B5AEC057C0308797C6B2A931B47456222D7B62C4CB303F66E641B1EB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690865, "uuid": "4d8099e5-ebc0-4782-a036-1a51413e3642", "value": "12288:pRlodDNO24ko2Cm3Un4afr9csPqWyKh2V51A66rLk+8dM:pRloVw24ko2Cmk/fr9c2n6uLkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690865, "uuid": "298400bb-53d1-4cb4-9391-58d147618ba5", "value": 862160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690865, "uuid": "49667cf3-149a-4a4b-85e2-6a837c3bb30b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690865, "uuid": "ff3ec6f4-bfcc-41f2-b089-5786aeac4a9b", "value": "mirai.native", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a07b8c0-e158-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766642922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642922, "uuid": "7e8da267-778d-4310-8897-1a6d95a6ab54", "comment": "Malware payload (Mirai)", "value": "83b54dafa33104b447ebe909d51802ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642922, "uuid": "92262eed-282a-40f0-9ed6-f31aa917b2e5", "comment": "Malware payload (Mirai)", "value": "5638e9ce4112805e3ddaeefa3fb8c4210bc2473a51216e37a5a1692376236449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642922, "uuid": "10c80ccd-1d40-4a4c-a983-e7e08c70e32a", "comment": "Malware payload (Mirai)", "value": "ab433fc1d0726805ef3fe7f32f58ff8800cfae85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642922, "uuid": "6507cbb3-3f82-4709-b21e-2ce78e07c247", "comment": "Malware payload (Mirai)", "value": "6d3a5678fc7f5b18bbcce0717eed844b451c9139a8ee2b36f0eb89d813d759348cfa44670ea28d250988cc3d5a1fc3d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642922, "uuid": "d3b3787c-f243-4a19-aae9-ac67cfcbd90c", "value": "T192A3074AFC819B21D5D522BEFA1E118D336357ACE3EF7212D9105B25778A82B0F7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642922, "uuid": "29ccae7b-d32a-4fc9-94a4-224d90262a12", "value": "3072:7aWzse+yersJHt+gA8VsEc/q6Zj+ylGE7V7+jlT:7aWzkvr2ZA8Vsr/q6Zj+CGE7Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766642922, "uuid": "23dbcffa-5aa0-40a0-a1b5-0f4f750a2fef", "value": 102428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766642922, "uuid": "5739a653-42b0-4b01-8377-10bf14298596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642922, "uuid": "637e3fea-6b78-4f4c-b72e-9961e07eba6a", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b719ce-e1e9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766705383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705383, "uuid": "a768e3a4-8be3-499b-90f1-bdd0995d14a7", "comment": "Malware payload", "value": "c0bfbf0ff41f5da040d78d39de5cec32", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705383, "uuid": "ee196b0f-2314-4cb3-b5bb-a8848b6eaf26", "comment": "Malware payload", "value": "564f4727127bd36af1765bfea2d2e18c30fc99a636641f795fe1a7722e161422", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705383, "uuid": "f4264579-164e-4c67-addb-d55b298cad8f", "comment": "Malware payload", "value": "596c8134e0a9f0168d11c1d30a1c2baf1d11503b", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705383, "uuid": "56679d02-3ff0-42e6-a814-45d013dfffef", "comment": "Malware payload", "value": "521548ea8b6ae8a58c82c6a8f480d26cbcdefc9d6c117d2e5f5cc762843e473407f0d09ff695e699048fa2e0764689f8", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705383, "uuid": "1e0203de-97f8-4e8a-b06e-82ba7313755d", "value": "T10CE2E9023E40358BE9A0CD368BB3DB5029683C46A63545B93FC1FB5B77F95A6C423639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705383, "uuid": "2deba851-ac68-45aa-9071-8b936d7a42fa", "value": "768:S7truPeSn3MSQ0SgInvttttttttttttttClllldttttttttttttttttttttttttF:2trul37Q0qnvttttttttttttttStttt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705383, "uuid": "591cca85-e3ed-4e45-bdab-ccdb48237fd8", "value": 32586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705383, "uuid": "683ef369-9b79-40db-ae40-9e204c2851af", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705383, "uuid": "4d8c9fd6-e8d2-4911-aa66-33f318d66a99", "value": "23U57_ComprobantedepagoTRANSFERENCIA.xml.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04355f26-e1ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Amatera)", "timestamp": 1766679795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679795, "uuid": "9fee1be3-f89a-4da4-8bfe-a6d5eaeee432", "comment": "Malware payload (Amatera)", "value": "e5cbfaac2c48fb375261fd5255a999b3", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679795, "uuid": "00abe08d-39b5-48d4-b144-2225ce791574", "comment": "Malware payload (Amatera)", "value": "56e3ac5f4be4a1ef51b87e1df3d940f7c8663e0f28842252790a422e29b6ad92", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679795, "uuid": "ccce1732-c41b-4957-83c9-c90f1085978d", "comment": "Malware payload (Amatera)", "value": "c1a163b7ade7ca2e051b8d63642875f8ded4b31c", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679795, "uuid": "b474671d-7c37-40da-ae31-d011f636b9aa", "comment": "Malware payload (Amatera)", "value": "0556113700cccf44c7708659252843a8765f224e3157b49ef8446d0914bc02431f9e749ee109e902c9a0121ab87105c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679795, "uuid": "a5e69c00-68fd-4133-bb38-1b39f4207393", "value": "T18F769C16A3A801E9D5B7E138C547961BEAB27852533197CF335C6A6E1F233E09E3E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679795, "uuid": "db783677-1f67-4de8-8851-8f3e27a19272", "value": "e081b8ce9803d5164dbd3d1763efe7af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679795, "uuid": "1f2afa6d-479f-467c-a5e8-15cb6acf5ea3", "value": "98304:oBqkwhkvxbUmwgLNWuKbRQEZlk0WfYE26y3uvYWme:oB4kpgmwmNFK1Qf0UMAYWme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766679795, "uuid": "095acde3-fbb1-4f1b-ab1b-c46000f34487", "value": 7493216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766679795, "uuid": "b67142ce-f1e2-4cae-92c5-9d96977c247e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679795, "uuid": "7a743468-5d49-403c-8896-34a8e2db0ac0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab18dd9-e158-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766642923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642923, "uuid": "6154b9d7-d444-4770-8b59-7f5bd26fe886", "comment": "Malware payload (Mirai)", "value": "2824d0a6863504269762ae0b3051a7e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642923, "uuid": "dfa10252-f97a-44d5-b04f-b9fa0f6c65f2", "comment": "Malware payload (Mirai)", "value": "580e34d52d440465c18c78ec56eb5425e7ec38efc799b82fd1379092d28f60be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642923, "uuid": "d84931f7-eda1-4695-bef2-5e849020f9a5", "comment": "Malware payload (Mirai)", "value": "ac79c7d87a8dd0f4bba9df662aeefdcdd16ad0e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642923, "uuid": "9b416cae-b9e7-4688-93b7-3c71551b638d", "comment": "Malware payload (Mirai)", "value": "ffcbb4abad7d88de637a75e02c6254f47e3607d3cb480037930629be31ef91e42dc35f71160b36585f7de43462f0bb6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642923, "uuid": "4d2072af-e00d-4975-b264-5eb3417bef45", "value": "T11563AF3AC86D5D54C56846B4B8F1CA781B137401E6871EF7AEC989A68003DACFB493F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642923, "uuid": "9b6092be-7027-46d3-bdfa-ded3b50a499f", "value": "1536:AaASJBq6pu6Fu/Y137OLLH/smRgUqYs8CjJEncT6:A8qwu6cy7OLzH/qYs86ucT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766642923, "uuid": "af9e1a63-5e7b-4ea9-868f-c41f23eff73a", "value": 68696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766642923, "uuid": "df210e1a-2fda-4588-963d-91c55906098b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642923, "uuid": "30385a85-79dd-408c-9669-2d2cc52d515f", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fac0bda-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690149, "uuid": "c3b50f28-e475-4dcf-b5d7-5d95cf29cfbd", "comment": "Malware payload (Mirai)", "value": "67d8a9c1321db463df7880d8d4dc61b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690149, "uuid": "6ce692f2-7686-4b90-9179-bd987d0d5cef", "comment": "Malware payload (Mirai)", "value": "5854195980979de3fd8c715a8a65036a4c0baf67fe39c6af2f987ea5bbfc46ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690149, "uuid": "717718a2-3546-4a38-97c0-35710ef2f1e7", "comment": "Malware payload (Mirai)", "value": "b924fe5a00d9259e5b2008186ae3b0cdc184b0d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690149, "uuid": "caf71617-9d82-4923-9296-984936bbba51", "comment": "Malware payload (Mirai)", "value": "0523a81d09052ba0b2eb1f42a20ac65562ed594f82b7924db165db525d1b6e1d7bfae3bcb10a868d31278b11510e0c02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690149, "uuid": "1843fadb-652b-48fa-a4eb-775ecc836037", "value": "T130B3A44E6E218FBCFBAC833447B78B21929833D636E1C685D15CD6015E7074E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690149, "uuid": "b64ffd3f-b72a-44b0-9ef0-47c90d7fc7e3", "value": "1536:KBpnc8KpsSKdHxPR4Jn8VcoP3ZgY+3g4jypGE1AbQgXyPdMxedYgWn:MxLIQR4l8VjP3CHjyD1AbQgiPC3gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690149, "uuid": "2503006e-414d-4036-a8ce-92ef67fd2a78", "value": 113524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690149, "uuid": "ba3b33be-7b20-4bec-84cf-75c77841fc5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690149, "uuid": "15b6c5e4-f0c4-4772-8ada-14958e4c34aa", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c935bc8a-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Merlin)", "timestamp": 1766666382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666382, "uuid": "2ec2ec2d-aacb-49da-bcb1-375c5bab3ed9", "comment": "Malware payload (Merlin)", "value": "7b13d4494a8483482f22330a5e4b5b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666382, "uuid": "94ffa779-3c10-46a7-82e1-46e64a578eca", "comment": "Malware payload (Merlin)", "value": "59a0e39ee85f0b91b458673811d6222a5cdd7ca36d6798ed9f3bc6f679478f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666382, "uuid": "a1c944ea-597b-4b2a-bc79-7408b97bcc71", "comment": "Malware payload (Merlin)", "value": "e817d27f31c7494e86afe4a64b08459175556188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666382, "uuid": "82c2a1a3-d985-4e39-a079-1c8e86fb5122", "comment": "Malware payload (Merlin)", "value": "3e45b811a5fa46d1699560ddcdc388904474f49f99b904e23b2bcae6e9e73032c88b1804f722a3bf94303560590c54f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666382, "uuid": "0acd41bf-3aec-49fe-8fdc-29d9df6c7763", "value": "T1B5E66D03E86115E9C599E270C5A6C663BA717C495B3327D76FA0F3383E72BD066B9302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666382, "uuid": "f0924f8f-2af8-4316-abf2-5f3986630b72", "value": "2cf9dd05dba75f9c4a2feca32339380e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666382, "uuid": "93090ae8-accd-4216-a829-057303e710cf", "value": "98304:3izxI3A57TWE75FHHPX3L334+1/6sswQ0NfMJE59rDvreAzm0w:3cy387TWwHHPHLwwQyfMK59T5z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666382, "uuid": "8f754b99-0c27-49d5-a2af-58f67675e5f8", "value": 15008138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666382, "uuid": "a8a1565a-6e6d-43df-8db6-0b859f54d197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666382, "uuid": "a48f37eb-7604-4ea0-b232-6c141484cdd5", "value": "SecuriteInfo.com.Win64.MerlinAgent-A.82525344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0398ed87-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (PXRECVOWEIWOEI)", "timestamp": 1766672922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672922, "uuid": "d45b747f-b99b-45d3-9604-d0252c0c7b42", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "44dcbe8985987ebf97426feb900e09cb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672922, "uuid": "db747fb7-0897-48f5-8efd-55c095eba498", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "5a58e9c9449c1a32f1bdeff37cf79d4bfefd3eec662dda829709bbf24ea7023b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672922, "uuid": "b6ec0547-d1a5-4580-97fd-492daa123e54", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "75cd456272f70614e3b9e4fa0c5c4c0653246768", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672922, "uuid": "4db316ae-2e39-4a4c-a8ae-faaaeb6a574f", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "84a3de1a22ce49870596e2065949117e6896ac426f9231250b3270a695ceabdf363ed35f2fe53e167d89373b8d7b85d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672922, "uuid": "e869a1fb-1d47-4d6b-ae63-34dca12c8479", "value": "T1F226221D375D5E301AAEEFE93D380610D8E40C668C4D7A65B4D64BCAD36EEE1223CE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672922, "uuid": "86d427da-ff91-4051-952a-e1410dbc3fc6", "value": "384:dI1IeP7I76PBw/7lHpUab9WX8z+DAj2NbEEt24Fi/fbKYEULQzQpiKX/rrrrrrr3:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672922, "uuid": "b5694202-d31f-4fb4-9932-4ec979f2dbc2", "value": 4695647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672922, "uuid": "9cd39838-9606-484c-a716-6c60510db1ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672922, "uuid": "2a6d50c5-efcf-4b5c-b006-533a3f26904c", "value": "RoomInquiry_Group.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96ae88e-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690864, "uuid": "908e8b0a-82a9-4b34-9410-53a3c8656c4f", "comment": "Malware payload (Mirai)", "value": "87a1e41369a7b091726bc275c619e632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690864, "uuid": "9e652d94-dd30-42eb-867a-974fe9003cbc", "comment": "Malware payload (Mirai)", "value": "5a87212dda3346d9805bc596faab9b8e81c4dbbecc7eff00377e91e5aca540ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690864, "uuid": "a1c69c28-c6f1-46e1-abf6-2f884a68b929", "comment": "Malware payload (Mirai)", "value": "f223f9741b9dd0bdfe70e0161178aeabe8518197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690864, "uuid": "787b891b-02f5-4e36-bfe7-209ecf8b0574", "comment": "Malware payload (Mirai)", "value": "8219d37d0a7844b314c2ced59d9bdb005260b8112d230cac9e4a5e935a5c61099e77b3785bb0e0968805952cf4920a2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690864, "uuid": "9b86b6a9-2a3c-48f4-9ddb-25c9be23c39f", "value": "T10F4102CA1F725EF9F05AD93C47330B3A37AA510843C14289E19CDA005EC430D85DFAE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690864, "uuid": "6a824daf-4180-4109-9358-61c51098e34e", "value": "48:Omr5E4GYg2H7i1eHju/9LuEpMn3gSRaBl:Rr56WH2nMEp43hEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690864, "uuid": "ed6ef2d1-7db5-4666-a8c2-d5663a36862b", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690864, "uuid": "e9336f92-bf83-40e1-a899-6b56f4483e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690864, "uuid": "ba61873e-f86e-45bf-a7b3-d42c2a46ebb5", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855560c6-e190-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766667127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667127, "uuid": "884ee4ad-62cd-41c5-98b8-062c850dc833", "comment": "Malware payload", "value": "afca12a4fe0b70c4638f92b1e3e963be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667127, "uuid": "99784ba9-7bca-4a9d-8c33-e60e20f5f2c8", "comment": "Malware payload", "value": "5b2f04d85a863dd0cbae4f0b80673559a66240cc0e96088c87813122f6070303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667127, "uuid": "3b2efd86-e870-46a9-8b43-1844761d3016", "comment": "Malware payload", "value": "39c8a2df496c4e4744befe9e034264fcd2dc9048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667127, "uuid": "4e194234-1934-46ad-a8eb-a8a20be82e97", "comment": "Malware payload", "value": "72c80ee9b84b1ea4e924f9a954ec2ed0c20e30b30ea0bc87956b8a26e762e089616dd9bad189888f8eb98f6032b66853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667127, "uuid": "15b8dc90-6e9f-44ab-b389-973e06bd1c49", "value": "T1B2086A4263EA05C4F9F7EA3589E65217D673BC166F3085CF224C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667127, "uuid": "dbfa11bf-b3b6-4811-92ee-5dde30329533", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667127, "uuid": "87512fc2-8564-4cd1-a0c9-e36875258216", "value": "393216:DIFqKb+iUHdZQKPAg9hAJLPU689cN0DshEQu58EASEhoIaE2lShUcBs4DJ7G15Ps:DndQmQJhnVn0vSa5rs3wbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766667127, "uuid": "8af179bb-9e5b-49d5-8c81-0c96fa309b7b", "value": 78161863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766667127, "uuid": "4492a820-49e3-492c-88a5-a64c8500264f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667127, "uuid": "9d4f69c9-2547-4d7f-9944-a82e029ba084", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4face0-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766665501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665501, "uuid": "88196be8-b659-498d-ba69-6cfbbbf6f7e4", "comment": "Malware payload", "value": "223f3db827ed53e5fe56c8fefb36f551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665501, "uuid": "35cc3616-d792-45af-bc75-7c8342c44386", "comment": "Malware payload", "value": "5c39d34d81f6bd0e9dfe590a3b1565d5bdf0fa3f0c92f9a2e1037bf74329ede9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665501, "uuid": "64b74e6d-23f1-4c09-a7d2-c6a8a04e1aac", "comment": "Malware payload", "value": "137aea241226c0dfaa7a4896f2d9568f22b69caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665501, "uuid": "8b88f179-a290-4cc1-8bcd-b91c6a1ace88", "comment": "Malware payload", "value": "d6256da988bfdf45427d62431779d6bc34d08d55eab539523dbe44a27353f3b6146fc9a7b95d11476d57effc091c4af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665501, "uuid": "6b959d2e-3a5e-4f82-9d09-d31588e9af2e", "value": "T1F0B3F810E610C439F4A610FAC2F207BEBE38AF21135611D3D7D1BCB99B5A9D6693096F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665501, "uuid": "7886940d-620d-4a26-a686-b90c93fbeac3", "value": "c8d4d20ce7c4084a5bcb18149597d774", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665501, "uuid": "7f7b2565-800a-411a-84ef-6b5e58739b83", "value": "1536:kBWAUsWgcFN2JgCV9Hn0cfCLz0iUsDFdudZ4qxf96vsT0GHPuHP05W:sPUsWgcFYvdfmUadI3JTDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665501, "uuid": "8f59b5a2-242f-43f7-969f-17c53f44b220", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665501, "uuid": "4f0ed6dc-b7d5-4436-bb89-f6b416d77f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665501, "uuid": "3967193e-8e9a-46ed-a79c-ee62aa2b752a", "value": "223f3db827ed53e5fe56c8fefb36f551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8c3485-e161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766647062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647062, "uuid": "b0ff2a13-d7e0-4285-a616-fafb1002be0b", "comment": "Malware payload (Mirai)", "value": "57ef521e5ab7432e7bfb5844acf25620", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647062, "uuid": "c5c7ed25-6b40-4fac-96a1-7c7ae84e12af", "comment": "Malware payload (Mirai)", "value": "5cb9cf194bf5942b83c43f61aea65670d7793c6edc4bd068199a70fc221f7188", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647062, "uuid": "9de59dc7-5b40-4b3c-b66b-bef5cedbd624", "comment": "Malware payload (Mirai)", "value": "31264155464915fdbbb4145a6e3d68f49d429c1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647062, "uuid": "ba30428c-e59b-4936-a1ea-805d695a9ef7", "comment": "Malware payload (Mirai)", "value": "d022d11a075d4650c8271392e26ac9841cca9b4b918a97127b206f2c4ed46db7121c3b3813f4b7ed623e25c1b08afdf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647062, "uuid": "324b7dd4-72ad-4872-91c7-61e414d2f0ab", "value": "T1DA837CC1AA43E8F4EC164271213BF7375B76F03A1029DA87D369A932BD42A41D7473AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647062, "uuid": "c738f892-a896-41d0-852d-96686635303f", "value": "1536:MfUvXxOEwGDb0RbFcXAxVOj6YFgZ4nY5fyRbZvBkFX9sM8KO9+wIzDO7RVmh:vhO30b0RbFsAx+6YuunkivMXZk9fImFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647062, "uuid": "1710790b-1128-4281-9084-b042cff1c7f9", "value": 83024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647062, "uuid": "94c1544b-8c7f-4bec-8c47-52e9b04d77f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647062, "uuid": "34cd6b94-1d1a-4dbe-97e2-283791965a56", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18da6574-e13c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766630867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766630867, "uuid": "5cf4ef92-110e-4c34-b183-315d5f6f4d58", "comment": "Malware payload (Mirai)", "value": "0c70ea72d2faebe1228aa87c025c4267", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766630867, "uuid": "09df0f2f-0156-4263-830c-d25ee7f0d17a", "comment": "Malware payload (Mirai)", "value": "5d688674b9f476bcaf74a9a1c453b79cca1045dfb3e30597696d399139bd17b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766630867, "uuid": "c20bcb50-aecc-4fec-81a7-b79387d44d19", "comment": "Malware payload (Mirai)", "value": "d7c81e62c2e8b6b4a810eef71665129082445754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766630867, "uuid": "8441bf3e-a9dc-447a-b2e9-e4f820924ced", "comment": "Malware payload (Mirai)", "value": "064482582d83b1cdf4136d0c89072d39870d3fa0a3a830ce6e8eea48205aecd604a2341ca8f141c0300231d7df6048cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766630867, "uuid": "c4ae1084-d059-4e1b-b146-3d9d6c3a1039", "value": "T130733B85BC819A12C6D5227BFA2F42CD332653A8D2EF7207DD255F15778A82F0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766630867, "uuid": "045ebf91-17e0-4461-bc02-594d06cbd9ed", "value": "1536:onSSzCmveJGARLvK/l8IY/9KMi1i7Wurz4svjv8T6:ondWxIY/9KMi10Wiz7z8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766630867, "uuid": "4f13cf57-ff15-4f68-9ddb-5bd1433e6bd6", "value": 75360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766630867, "uuid": "949b4171-b209-49fb-a703-d8fdc4b0d0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766630867, "uuid": "05f4a36c-4ce5-4330-820a-160adfcd418c", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625c0fbc-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666210, "uuid": "84a6fe0e-19a5-48d5-ad0d-cf7920775a02", "comment": "Malware payload", "value": "72a3fb491adfbe2dea7e8396bf972834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666210, "uuid": "85a834b1-cd56-4156-9389-a081ca37e031", "comment": "Malware payload", "value": "605d6268505803ef9d6cbc71e574c642b55999304ba8a78dbd7e4e6e1c56da4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666210, "uuid": "0f5d9109-d2ce-429d-ab1b-1c8f026e9140", "comment": "Malware payload", "value": "3432d93f15cfcb968e4f19d33712ccbfc35bebb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666210, "uuid": "3bcee55a-db36-47a1-8371-deb36cba693b", "comment": "Malware payload", "value": "7fd6f76a4390d864fe2493982f5eda78a4583046e8a0ba13b5c888e7cbc6bdf8be790aa4c894c894df757535f2316bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666210, "uuid": "c101ce05-7057-4b15-9819-1ad7617dcbd9", "value": "T1D9538D13B7F2C032F16695B409249B624FBE7C2156B5D6AB1B8C10E8AFB1690CF35367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666210, "uuid": "fe502537-dd2b-4516-a86e-e24114a03be1", "value": "55380ca6450e841d3d090c9d1307b680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666210, "uuid": "8c866899-6fad-4ea0-8951-da2ef7216026", "value": "768:SUp9fff0yKZax2wNfEiMgQacRZidIZMq+sZhHxDPakkjLEDDNVntAiNwZCi3AhRE:xf0yyaRlDsAqxpSkuE/AAhoB2yk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666210, "uuid": "bf91b7e6-f44e-482a-9b6c-3d9ea0cd15b0", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666210, "uuid": "3845c598-0785-48d4-9d06-399e69abeb2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666210, "uuid": "efe25004-b585-4150-a776-6e0fd3c72c64", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f5f5bf-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766690111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690111, "uuid": "dc369548-8dc9-40da-9e78-afcb0f6cb8f7", "comment": "Malware payload (Stealc)", "value": "179ac1047c00229c3d041b042fccffa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690111, "uuid": "d83c4e19-2369-428c-85dd-2a8acf6204d2", "comment": "Malware payload (Stealc)", "value": "60d43ddff6cd33da3f52147994b29c4f9a993e8c1f32dba4c51b6667bcc4ef34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690111, "uuid": "235c27c1-a522-473f-9df0-813428dc070b", "comment": "Malware payload (Stealc)", "value": "64e1c651e06ac7646922c109c77d4b0d0e5f3ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690111, "uuid": "3b0a83ff-78f3-4a4a-bb39-d7fadd1ec205", "comment": "Malware payload (Stealc)", "value": "523a3ff2ed843912555f08e6748889c842b523eee8be8ceae32b3c6d92d9f2efe42344d73cb8ef04626d6fcfd5da1ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690111, "uuid": "023ffc8a-0aae-4818-9338-a32d290ee572", "value": "T1C915238F66BB44FEC02B01B281F10721F9B9BE2158605C3B6F88D5658E19C963F27B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690111, "uuid": "3411b75b-89e7-48eb-ab6c-4c98ff0be036", "value": "313a05c8f3f31305e238ae143783f8a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690111, "uuid": "7288f174-3165-473d-b275-ff422d04e78f", "value": "24576:E87gRA2zxCNPNs8SferehGNnHBHWAComNw8cVHtIB2GMDIy:E8SSXyVGRHBHjlf6nMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690111, "uuid": "a6a6f879-bbcd-4a31-b6d6-e3736412543c", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690111, "uuid": "7456f48c-760e-4a89-9cef-3ae36b4f41bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690111, "uuid": "c5bb3699-ce24-4f61-a508-4114161e9b0e", "value": "179ac1047c00229c3d041b042fccffa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4828a2d-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1766673300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673300, "uuid": "3865f4bf-a646-426b-b9d6-176a155c95a7", "comment": "Malware payload (STRRAT)", "value": "b673b61c20943b2cd60b6887edc58f06", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673300, "uuid": "f32c7f95-2941-4ed7-b75b-288754d51216", "comment": "Malware payload (STRRAT)", "value": "612fd9e1b4beba5f987e755077d784c2195a66725a795891465de0929b842406", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673300, "uuid": "13a41ba0-dfe7-413d-9dc7-a6d792e629ef", "comment": "Malware payload (STRRAT)", "value": "d3ee66fecb65d7d40103d940d7c304ef57c106a4", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673300, "uuid": "3096c3a8-383f-4442-90a5-a1894cfbe1c6", "comment": "Malware payload (STRRAT)", "value": "3d1fb3eb482d0511aeb68827350f7f3e392a01ea60a9b25893af51dc45d762b95265152ca3a7628ed8c23fbab4b5de30", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673300, "uuid": "97fb6412-fcc6-489e-8e90-6ffdd2c15175", "value": "T1D524D0143A809079E363A1F2C8699305F4B1D8BFC659B1970FF1EC3FDC568A56E0A786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673300, "uuid": "5dd16f4e-7c66-4d68-8686-5d0435c92c55", "value": "6144:3qo5wn2on4gdoiqcCtWUIC3cJJySe/tcQYxdA+OcsG:52X4sfC7IQ9SedcsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673300, "uuid": "f06ac3ba-0a4d-478b-90ed-848d10a9c1f5", "value": 211929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673300, "uuid": "3ce77892-b3f7-4a28-9f50-2ee056dfd1e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673300, "uuid": "9442280f-255f-4979-a7dd-a7d339ae206c", "value": "FIYAT-TALEBI.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233e903a-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700893, "uuid": "6b35f9d6-ba6c-4098-9f7f-212ef48b6c71", "comment": "Malware payload (Mirai)", "value": "bd9d945ab67194a0f6097f794d8651e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700893, "uuid": "b5a783ff-d48d-4e7a-b3b8-aefbeceba0f1", "comment": "Malware payload (Mirai)", "value": "61656e81ea21850068cdb7df34b9c30402f02ccc9a0c5799a9066be85fed5f99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700893, "uuid": "99117163-5e83-4753-83ca-088a541b8fcc", "comment": "Malware payload (Mirai)", "value": "3741c067486afb45acbce33dc50faa1c09d0f812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700893, "uuid": "0fb5246b-3bf1-4aa4-b3b1-e41d563dc9e1", "comment": "Malware payload (Mirai)", "value": "9f3bfa365ba86c6c30fe87cd9cafa785b73c2a08e0149db3bc71b9366835d474ec1eed4e8d78e1dd7fa232a8a1569120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700893, "uuid": "f64bc74c-cbae-4567-b601-2afcd9d87640", "value": "T175C33A41F34BE1F0DD8205B0115BFB37AA3269762134DD6BEBE4FA737C616529806A2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700893, "uuid": "1a37bb98-af71-4555-956d-e237cf8e0583", "value": "1536:5zo9jm/+SVjS/PWhduvfQ6BxtkfjrzvUIIogS6v5dfZfz7unAcU0310fIoVkZ0/5:lU72IWhedxan4w6tiRaxVJsmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700893, "uuid": "e13d9c35-e143-468d-a66d-e1f9328fc30d", "value": 129328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700893, "uuid": "458a2e55-aaf9-40eb-a9ef-f03976c625bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700893, "uuid": "868e5bdc-e29a-4ff8-8ded-417e627babc0", "value": "i4_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfdc411-e124-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766620808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766620808, "uuid": "7b25167f-ec15-4651-a107-2ecb8539ec20", "comment": "Malware payload", "value": "e8d073bb679500fb9e3ea4e30832e1c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766620808, "uuid": "e8da4af6-d96f-4eff-aae8-9f7c218ce9b1", "comment": "Malware payload", "value": "6167c7cf2a8fb27db5f4438e0c67d83cf081a35b36a5e7514c4616608080b4c2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766620808, "uuid": "232cd1af-073a-4b24-83ec-000cf905a8cf", "comment": "Malware payload", "value": "9a655c2ad1a2b56dae3f5f06fc3b82c09e17655d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766620808, "uuid": "6996a8b7-9e75-4588-8e15-8b0f34d805cb", "comment": "Malware payload", "value": "b80a8f5a186964cae6b1735c14f441da3c42e7753a0efdfb55bdcec8fc63053916766ffac9b02e0cc29db1a9183bbf25", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766620808, "uuid": "8a20dea4-1212-40cf-a4c9-0f267de379c9", "value": "T11B212CFD006274168C89CE44A116D8CBC12C9EF6B44BC916BABE1D7D4E94E7138C6E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766620808, "uuid": "4981cb15-b281-47ac-933b-3be2f47f2c2b", "value": "12:KrKt18gvttNI2sexKdKCnD0dW/9drdRJR8RzSRRqSa5aSF6SSAGnPqawLqkqdxEp:QK/vLNI+KdxNz2lqYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766620808, "uuid": "a368e7f3-96ff-4fdb-9ca5-75d3f4faf1a4", "value": 1417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766620808, "uuid": "44da9bca-97f8-4318-a82f-491e968ee6a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766620808, "uuid": "fb00583a-88a8-4ab7-b1a5-311d8adba0cb", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4180c3-e154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766641366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641366, "uuid": "0641bbc0-083a-44c6-a212-6ded0ef5c528", "comment": "Malware payload", "value": "5010170339cd5be18dbfcf968eff1daf", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641366, "uuid": "777b3b78-5323-4f67-95c9-8add41cfcc3b", "comment": "Malware payload", "value": "626ec1fa145051853e353adf624e2cf4227564c156c1c6cf72f2546fc7d25460", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641366, "uuid": "9ff288b2-3bee-439d-9175-294abdd552df", "comment": "Malware payload", "value": "8517563b738a6eb025f0b36fc7f52a7d26ec3144", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641366, "uuid": "8a568bff-7067-4161-a93a-33e55147b617", "comment": "Malware payload", "value": "dc528139027bf8bd33100a07049e1b4782b3f74d060a386101e579647a8ffef3bd284dd583a8c88dafe49702c79ce44d", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641366, "uuid": "aed80b1d-a628-4323-9642-773c68b2c507", "value": "T1EF4195B02B76DBFD15C0226A3A39D94D07204B466144FE4EBFC5DB44E2481E562DD34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641366, "uuid": "121e62f0-6dc1-4c60-95ed-a5de1a6363d7", "value": "48:0hTAOaRYMFcg3KbUWbsrQ3FBw+RORvB3vB3Tw1Aka134yGkFa1T:XCacg+Ps01pwhB/BD2goy4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641366, "uuid": "f7e3b5fe-c49c-4e60-9ed6-447abf2483f0", "value": 2092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641366, "uuid": "d7124e24-ffae-4932-9a09-dc09b5806f55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641366, "uuid": "f0d93a85-b763-4b5b-a1a5-208f60a96b1e", "value": "626ec1fa145051853e353adf624e2cf4227564c156c1c6cf72f2546fc7d25460.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7056d4e7-e157-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766642611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642611, "uuid": "2b1e891f-6240-487c-9a82-a04e2ee0d4fc", "comment": "Malware payload (Gafgyt)", "value": "52fe9bbcb486665c1ce0c75db8084569", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642611, "uuid": "bd8c6fae-f63d-4d85-add4-eb790d1f8448", "comment": "Malware payload (Gafgyt)", "value": "628c8f319f2aec171effe37e8fad0faeab04abe09e9ff9c8db27e7de6b25a60e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642611, "uuid": "3de87bfc-d2a1-473f-93b5-26f5836d7c38", "comment": "Malware payload (Gafgyt)", "value": "f09153e8a92dc6dfd914c2bc6002e5e3f7db3800", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642611, "uuid": "1e9c66fa-e1b9-4e86-adfe-9e64e84090fd", "comment": "Malware payload (Gafgyt)", "value": "d2c401995aa188f78b44474d0bc4c21af1c2b41b5045e655baa0f507add9f59de11ee806e6bf0e7e9db9b4781dc808dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642611, "uuid": "6b5300d3-cb56-4b77-8397-764a03e0f07d", "value": "T10912C388F1E112FA7CA548466193937C8D44C1E1607BD9B6D848D8FEBAB86CCA07DF47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642611, "uuid": "a323fec0-417b-4f35-8ab9-d69bbff3410b", "value": "96:Ax0iRoLngDEy9q5eSkYEfKeWs45mCIYYPS+ywaPeL2K+mSMcRGqkwCIeCuCou8SI:g0goLngiYCHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766642611, "uuid": "81678201-5f21-4d95-90dc-129ed68dbc09", "value": 9432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766642611, "uuid": "b262fcbd-9784-4002-b469-5f1061f5533c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642611, "uuid": "6d02f1ea-5619-4f25-abe7-1bd69d08c8dc", "value": "rondo.aqu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3100bce8-e1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706929, "uuid": "7990d1b9-fe0d-47d9-a490-326873f0008b", "comment": "Malware payload (Mirai)", "value": "4acf02ba04b3ae43ac3416cc30894433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706929, "uuid": "0a8a8bf7-e2cf-4fd9-8b53-e115a77686b9", "comment": "Malware payload (Mirai)", "value": "62dc297f46f677dc38e25cef14ffaa8107d96a40873842874201e21c2f0882ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706929, "uuid": "8b0cdda5-6593-4c0d-80cc-d57a5bd46920", "comment": "Malware payload (Mirai)", "value": "24adb12c70edf43e8315885f9283a57e644bda80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706929, "uuid": "86fbeb6a-4a6d-458c-9c59-1f27a5f91c07", "comment": "Malware payload (Mirai)", "value": "bc15a996c686e87685080797207f1480ff7966efeda6c15a33d77b368a28722cdc8a1995f6703075a88bd8e68490fd1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706929, "uuid": "a216aba6-b2ee-4212-b66f-cfe32b40ab21", "value": "T1AF832985B881C613CAD462BBFB5E42CC332653F8D2EF72079925AF15778682B0E3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706929, "uuid": "4a6a3b50-9f23-4123-8ff8-d567ab88146e", "value": "1536:CIkS3AddDn+GawLseooENwLOjzr3QhKMewQxCJhKaiW7UifyDUuvzT2bVRIH:CIzwbLEGc3CKMeXxCJofW7930zT2wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706929, "uuid": "09c75c69-f345-40cb-ab8e-7fe3d345d15e", "value": 84472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706929, "uuid": "21fa8af3-0dc7-4c18-a744-97ce7a8b02e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706929, "uuid": "33c621f7-1e54-4166-b81a-e0736843b8a8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5d8f3a-e188-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766663780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663780, "uuid": "ec409062-8ef5-41b8-b9d6-4037985495f0", "comment": "Malware payload (Mirai)", "value": "5c8aa91ef29b360cd670c7c85ad6afef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663780, "uuid": "bbc40395-6ee3-43ad-9a8a-e89617c6fc73", "comment": "Malware payload (Mirai)", "value": "6326910cbe7daf613f8c6532f3640e07737188b50b36dc994aa5e6f3c27c5e21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663780, "uuid": "f1bafc90-0207-4095-861b-9d7804a1a43e", "comment": "Malware payload (Mirai)", "value": "fd9bd86378bd197569678636af051abb8fc796b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663780, "uuid": "cf8c4a5c-06f9-439e-a218-e9a370b6cca2", "comment": "Malware payload (Mirai)", "value": "c254b703b95a1a0d62b2cac72a238ae640625b2d841deb95b437e86be2f0316de881e3541f4d02544669f655bb580086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663780, "uuid": "3e7098c0-907c-4929-974f-dab22645e61e", "value": "T1C473BF73C91BBD84C45C8A74A9A49E381B63E40186171FF61AD6C66B9043EECF60A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663780, "uuid": "481fcba9-0191-449a-9403-6cc6c2cbb601", "value": "1536:6/Ewp9da1i7OfwtdJFajWa4X5LEzguK8roL543UCdgq:6s6Dh4SJ/aXgB8c43Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766663780, "uuid": "b3a7270a-00bf-43d2-a270-05d66cb5fbf6", "value": 76712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766663780, "uuid": "3f379af0-1be1-436a-866d-d2b88f8afad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663780, "uuid": "c1bd1671-ab09-4fdd-bce4-3371e57f4f52", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7e1611-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665472, "uuid": "c6238632-a276-471a-a3cc-acb02b5a0961", "comment": "Malware payload (Mirai)", "value": "84f986545e928214c05f24bdc10e951e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665472, "uuid": "bd308307-1a58-4dc4-a0e6-fd2bcd4c4373", "comment": "Malware payload (Mirai)", "value": "64914fda3cdb913e0bf5fea6e26d589d4fecfc5885156ea235f23a2075f0a75e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665472, "uuid": "70bc4b54-3274-474c-84b9-651dfa0e183e", "comment": "Malware payload (Mirai)", "value": "510be65a196cd78ebf2dbcfb1d81dea1a2d3fb9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665472, "uuid": "d2d58eba-727d-48f9-9f3e-5fd60e54f7a6", "comment": "Malware payload (Mirai)", "value": "e498a5856603aba44e06cf2dd1addd7e0f1ab9c5d365878d94362e584cac824cde2da00817e26f0894745449dce70ae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665472, "uuid": "93ffc2e4-47d8-4aa3-9ebe-05f4e94350b8", "value": "T1BE936B22BD792E2BC4D4B57F22F34324F2F1478E24A8CA5E3D610E4EEF2965021476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665472, "uuid": "abce57c3-cace-42ab-8471-8590448d9017", "value": "1536:tJmHMujpMySkjfew8dg/K1752/46uZtDxayYl5lPt0pi:H5IW4OVBlxayYXlsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665472, "uuid": "229490f0-d035-4244-8078-1c8bc2195c61", "value": 96376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665472, "uuid": "97edb0d7-b157-43b5-82aa-1667f291f030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665472, "uuid": "b6e590ca-934f-4bb3-9c13-5263572c1b71", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0401947d-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665192, "uuid": "31e1b66b-c668-4e16-9f91-e419c7931a60", "comment": "Malware payload (Mirai)", "value": "3ee87b2b6af9999e39ac88233565796f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665192, "uuid": "5bad9c18-eaa2-465d-bd40-2baa31c20e57", "comment": "Malware payload (Mirai)", "value": "64a37aa27a6f9c96c0bdc5920ee8ed8e3b49c08673f6a5b6555baa97280578c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665192, "uuid": "7ce072c9-7e17-49b3-ae49-9577da670261", "comment": "Malware payload (Mirai)", "value": "93caefa33d09d0449c279c74fd49b2e7f25e77b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665192, "uuid": "9220a161-0592-49d5-bf20-749c38641ebf", "comment": "Malware payload (Mirai)", "value": "db655e7bb92eab328e8fb4464e07ffa4ac46234163e710d0605e030b4f2196d2b0df9dc2c9eca9ea80148589a5fc2d0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665192, "uuid": "73b611a8-6cea-4296-8ded-73a28b0f3c9e", "value": "T116A3A6093E619FBDFB9D863547F78E20928837922AE1C646E15CFE051E7034A381FB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665192, "uuid": "3d50807b-ad51-4680-a969-9d31bd052312", "value": "3072:zyUFHblgQeHCP5C6XoB2DQfn0XhZzmgJP:rFxgQqCP5JDQfn0XhjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665192, "uuid": "43646e35-1b62-4021-867c-c23d78beba60", "value": 103507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665192, "uuid": "9f9cf454-1ea8-41b9-a27b-a39a01dd6b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665192, "uuid": "67823fe3-fc58-44fa-a5d9-8881f1865a3b", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9e1f65-e1c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766688183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688183, "uuid": "c227b085-9943-4792-8730-cb55da667e34", "comment": "Malware payload (Mirai)", "value": "3c3dd0cb709de776a47f29e04e596083", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688183, "uuid": "3e56d3ac-1690-41d1-90c4-714c4cb43abe", "comment": "Malware payload (Mirai)", "value": "6585629f68ba7acf6027deca1da9ff43d0ad34eb39b20d8811a05cf8081e6e70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688183, "uuid": "82993d09-0e8b-4e61-89c6-2245f111f84f", "comment": "Malware payload (Mirai)", "value": "9eba2a6f0e94db4b6825034fab798fbeb0fdc1a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688183, "uuid": "b144c74d-a95f-4df6-bbec-328a055b1df4", "comment": "Malware payload (Mirai)", "value": "d3a0242a1598db73939483d7d2ae85bc205ee43ce21b1c0ebc967e83994787f1b32e33980128fe234183a133c1817033", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688183, "uuid": "77fc53a2-3fcb-417a-af98-2e157a6d4ab3", "value": "T1AC532902364D4B5FDED15AB0052F07F087BAA7B050F0B986251F2B96837AE761447F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688183, "uuid": "02091fed-669d-4e8f-af31-088931d53a38", "value": "1536:2QmT7Z/xpgUzVmITmzW9XrEvy7CYFyww/PJro:2NT7hxBTm6BKyWWyt/Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688183, "uuid": "8a1afab0-683f-40cd-9692-1d0e8889e8e7", "value": 66664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688183, "uuid": "f13381f4-3725-4c72-951e-0cd45bc93a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688183, "uuid": "d0656b3c-18cf-41a6-b2cb-a987549a79c2", "value": "shadow.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b037ac-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665198, "uuid": "778cf570-62f9-4d17-9f04-e64428d66aaa", "comment": "Malware payload (Mirai)", "value": "54c561781cd364fdb92609f10cf4bf84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665198, "uuid": "7f7ec67e-5316-4acf-b89e-120dd55b858b", "comment": "Malware payload (Mirai)", "value": "67153c56032292291fa8a501f62a04a0ebcb0e82c1079df173420941e857d67b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665198, "uuid": "233db299-dd91-4c35-a10d-0c3b9cfd48e1", "comment": "Malware payload (Mirai)", "value": "1680c51fadcaba33fa44c782a2cf48f4c663fe0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665198, "uuid": "740e6f5d-7642-4781-a35a-502579ba7d3d", "comment": "Malware payload (Mirai)", "value": "599b3d4d964d6d62005471dac175fcea5a3f8855507c03f9787fff416ca7eecea7f278c4af7b2dfdfc168b0dcdb67eef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665198, "uuid": "82bf2d0c-1c2f-41ea-b672-ba54d6067509", "value": "T138258D2AB2B2F6BDD017C0344BDBC6A14531F0756A312D7B32C4DA353EA6DE42359B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665198, "uuid": "d37820d6-29c2-438a-ad77-a52bca9bde16", "value": "12288:l1xm4Ng7tNzJzodZHW3+Yp3ppC/wRhRBbFeOMJbUobtu8Y0QL+kayLhSPhHX+1m0:l1o4Ng7zzswnhE12obtuVL3mAo6a2ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665198, "uuid": "9f0b92c9-187b-4b65-ac0e-432602d69f1d", "value": 1043528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665198, "uuid": "6392ecf5-d0b2-4306-82a1-f8519e7076b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665198, "uuid": "fc08152f-0c6a-410a-98b7-21daea781b2e", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a96430b-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766694006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694006, "uuid": "3be37254-6d93-4973-9a5b-bbe3c2c831f6", "comment": "Malware payload (Vidar)", "value": "e226f9ac6b062ca0af4b2b75316de0f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694006, "uuid": "7ed8387a-2f32-49a8-a40a-71530973b043", "comment": "Malware payload (Vidar)", "value": "67e69f4d9f3e406a05755b547750a15ab7245471a0193325fc755aac7efe68f7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694006, "uuid": "73b37096-00d2-48bf-aff9-80662e4083bf", "comment": "Malware payload (Vidar)", "value": "81ef220ffacbb6f0b18adf8a7f9d30ee145bf33b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694006, "uuid": "6d1fb1b3-d27a-4612-8b95-58ea1e4f597b", "comment": "Malware payload (Vidar)", "value": "3e13c04f169fc63aed4f86b7bea4bc80890cc854114a0511af2c92b17e44d4c2fbe6f4a36e70369fd4bff2724ef7f0f9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694006, "uuid": "b38b1e44-f364-47b9-8965-f508bda8175e", "value": "T10FF313BF063886BDC35D9138316909B5E06533AA752332BE38E94653A05E0825D2FFDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694006, "uuid": "602fc239-b463-4e7a-bb73-6cdd9bed81e9", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694006, "uuid": "fec0c1b7-484a-442d-bfd9-5ec5da410548", "value": "3072:oeNm0Q2vXtMS15KAtrM568fiveG6hY8Wi4EGpNDFFtmLMTj0yk8xOuNGAQj:XhQ2vXtyi4I8fiGjLsNDkkj000y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694006, "uuid": "511a0639-60e6-49b4-acd8-d2c1c9cb70c9", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694006, "uuid": "90b8f132-733b-4e8b-b734-295f0c3a4747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694006, "uuid": "9ff3e7be-444c-4837-a2c4-3ce1c5e97d23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b5efd2-e1c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766691074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691074, "uuid": "e2a5feed-c5bb-4153-9b0d-cdddc4047b51", "comment": "Malware payload (Vidar)", "value": "249a7e5f1e1c3af2b97f6fd30ae62558", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691074, "uuid": "5a8d7e87-c4b1-4338-8132-9c73850b86eb", "comment": "Malware payload (Vidar)", "value": "6b4ef1e6154069d6fabe151810017f7333dc41c8febbdcefc93c1d6358cfb278", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691074, "uuid": "d0a4904c-19d0-4771-93a9-a9973ee5d712", "comment": "Malware payload (Vidar)", "value": "debcff99a2aeaeb745cc0e3e0a62a91a4c2d2e38", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691074, "uuid": "f4c2faef-8c91-4416-8558-f018f9f1f882", "comment": "Malware payload (Vidar)", "value": "265b81b5b495a4faa7655f19d6ad52e1ac3b2233558205f75a24bd5f87dc623629b9df0c52d3b298639cad52234b0379", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691074, "uuid": "14dfbcb5-d6cd-4460-83d4-ea005e9d5664", "value": "T1CD14122CD7B0CD8AE1A6C134C1BE0F18FD13A91FDFD42C9EBAC35832B6556551E81AA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691074, "uuid": "8cde5727-8a3e-4a77-9658-2071988c7434", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691074, "uuid": "6e47dedd-33d8-4671-8e2d-f5dfc8851f45", "value": "6144:+cw2IhvOvuXYadYBnqdICbot4NeQqBtVAGxd3:+52IhvOvuXY6d38mRMT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691074, "uuid": "afe01960-692d-4f8f-96a4-1ac9bbc169f8", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691074, "uuid": "40e942e5-c74a-476c-860d-0ffdefab9fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691074, "uuid": "bffc49fa-8b15-481c-8ccf-e44f7c7a03af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccf4137-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666630, "uuid": "9bdca1c8-8fb4-4592-b724-3a5e79940aa6", "comment": "Malware payload", "value": "f507501f44c3f93bd8846b59e02c822e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666630, "uuid": "7eb6062d-af03-4969-a184-bedc323de6b4", "comment": "Malware payload", "value": "6d3e82a566dc9565009860942bf30b646a1f67d4963effef1d4117687b4b1c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666630, "uuid": "bf98c152-aa4f-4887-80f7-b385741ad040", "comment": "Malware payload", "value": "a62aae98dbe06c7edf88ac5ff70317423bb91fdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666630, "uuid": "0be90945-3487-44cc-a77a-6e276db9491f", "comment": "Malware payload", "value": "32bd9b02855207a692d43729d41a40c9badaab842d5c0b28bd36a1398e91868d7a67edd99f3bfa9fa7d239880cea7e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666630, "uuid": "acd24a0e-9a84-4662-8bca-e558c0a6793c", "value": "T1500633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666630, "uuid": "81a57b00-722b-4f7b-bcef-5a3c840f98e1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666630, "uuid": "774c492d-ff2f-46ba-be92-ba53c9323290", "value": "98304:axT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:e2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666630, "uuid": "c08377e6-1c68-4ef7-9942-8ad4f586bfdb", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666630, "uuid": "41201bd8-910a-4915-8531-d85dc6eaf390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666630, "uuid": "bff34fb4-e591-4388-be8c-9f012540d599", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7af08d7-e1cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766692552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766692552, "uuid": "06a43056-58f0-4bc3-bf63-0847590ce37e", "comment": "Malware payload", "value": "47e2a759f3630fe440d6be957a873ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766692552, "uuid": "b6b98eac-8ee7-4dea-b777-e6ef451d0d73", "comment": "Malware payload", "value": "6d439a713975486ede80fc165365c095869a81afbdf98481cdc5ffd07ea81c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766692552, "uuid": "547c5b48-f2de-4c93-baff-d28fbdb099c6", "comment": "Malware payload", "value": "8a37ebecfac2d6b4c539282a72d05a07112c87f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766692552, "uuid": "822a0894-3193-4377-aded-db264eac967a", "comment": "Malware payload", "value": "6d72b1ddf17702d15704b9d746b6bd886f75a38d36557a4f467255730d7e8d07b4308be4ba990d514c6fa12814973af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766692552, "uuid": "fd6f5bbc-ccd9-430f-83b6-cf6c24a67263", "value": "T14195F15AA7B610F9C1B7C17CC1839117E7B670654320A3DB07A4CA6A1F33BE1A6FA750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766692552, "uuid": "0250e03e-3823-4773-acfc-fcd220a9883e", "value": "f74a7d3ff4ddcbb7df99a140c8e1c8d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766692552, "uuid": "121018ad-bfc9-438f-a294-6031a13faf22", "value": "49152:RMtGjPRQf26MFYrqiKgmWIQfTb8qkQ/F1iLS+uCNT:YO6MFYrqiKgmWRbll/Cpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766692552, "uuid": "86aabf88-c1ff-47cb-9b88-d08ec3f64118", "value": 2038784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766692552, "uuid": "e0b7a6e8-6c22-400e-9ba8-04eaf3a02089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766692552, "uuid": "ed11354f-b660-497a-b2fc-4b29e0a8bbe0", "value": "Fortnite_Private (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7eaf875-e188-11f0-a129-42010a9c0007", "comment": "Malware payload (Merlin)", "timestamp": 1766663776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663776, "uuid": "f0dae43d-aa45-4ed0-b54f-b2777d8e79b0", "comment": "Malware payload (Merlin)", "value": "f92761a9535af22f986e780a04c72e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663776, "uuid": "c0bddd4e-d001-4fb4-9298-42a65b5732ff", "comment": "Malware payload (Merlin)", "value": "6d58d77705bc436461376bfaf7399405e2e3e46570e12409fa84f029b03ece0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663776, "uuid": "93cda89a-fa4d-40c6-acde-0028d9f4d7d4", "comment": "Malware payload (Merlin)", "value": "2085754a3d959a38c1ac55cda55b5678302ec94b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766663776, "uuid": "e1e63fbe-93c5-4d73-a476-0c756db5e994", "comment": "Malware payload (Merlin)", "value": "9155e834ac4ccd151148ddb9c5c96ceabea0e752cf1a526fe5d141e8aa3257de5fccb87d67cf32681f3801586cf1f4ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663776, "uuid": "1ad42bee-12a0-4578-a915-43b970660a3e", "value": "T192C64A43ECA255E4C1AED5308A669263BA717C485F3123DB2F50F7782F72BD06AB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663776, "uuid": "5ea150cc-2622-4886-a4bd-c7abcfab75e3", "value": "98304:eOImI6+S84GsBI46eqGWkUHOXc+JBuwkeXCNPAwA1G17irFEf:eVNS8NoI4JXUooPAwzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766663776, "uuid": "fcfbaf16-164d-4530-9100-e310bbf213ac", "value": 12185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766663776, "uuid": "99b2bcae-cb4a-4ca3-9975-94f223900182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766663776, "uuid": "f98c0883-8572-42c8-ad84-416d548271e6", "value": "merlinAgent-Linux-x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781e1b10-e1ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766679131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679131, "uuid": "4a5c4f4e-3432-4f88-893c-68015e432a7c", "comment": "Malware payload (Mirai)", "value": "12941c7e826b106c6d0da0ed52702e33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679131, "uuid": "c05fb30f-b902-45e3-a2b0-b11f25d1bd81", "comment": "Malware payload (Mirai)", "value": "6d80b1a080c4813706008eabb39c4194fe0ddd06cf87333ba60d61bec476c25b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679131, "uuid": "f81110d1-226c-403f-86a9-bee7525cb8cc", "comment": "Malware payload (Mirai)", "value": "f97cbd20837ed8cef28e144c2025e268f14692ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679131, "uuid": "b64ed30d-eb40-4875-b5a6-abea02933aa6", "comment": "Malware payload (Mirai)", "value": "247b242dd1e0b224996d2ee72ecb4c6f0ff016b9e74cb257612a58b806d712054113115575360525284a57131176d3da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679131, "uuid": "9373d346-413d-4325-a3df-2ccfda12c21d", "value": "T13A934AD6F400DDBDF84EDB7B8423090AB630A35155830F3A629BBDA3AD721958D53E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679131, "uuid": "59a399ae-f01c-4f09-8365-2a758fdfcb7b", "value": "1536:UTM/I3wSREuKP6sBMya+ZyvH3q+em4Q/E8fxpRhX0Z+LAYe4TCvys2slgm:uEuKy2LaH6+etQ/hRnLLeuGlgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766679131, "uuid": "932067d2-9f91-475c-93b0-a4af5b4ea1eb", "value": 89568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766679131, "uuid": "e3ddbccd-4617-4e5b-834a-10f5c0882950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679131, "uuid": "036708fe-0e7a-4a57-bc38-672c6ea2675e", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3a7c3c-e178-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766656890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656890, "uuid": "e7488eaa-4d7c-4d5b-8bf9-af8993e02516", "comment": "Malware payload", "value": "88e3995f9dad257b00cbcbc6c66c6644", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656890, "uuid": "0636934e-7996-4534-a418-86659ac6eabb", "comment": "Malware payload", "value": "6deac951bab9c3aced6c961a94b800b8281373e0cae5234b4f21938e7547947d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656890, "uuid": "e5b0d1bc-dc7c-4c1d-a525-527e122065cd", "comment": "Malware payload", "value": "32c9539f78fda680a3e18e89144b0e6e9507757f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656890, "uuid": "9b150aac-ddb6-499e-9aa1-19529d30c5d2", "comment": "Malware payload", "value": "1266c5e128f8c1d5d4b2cfc30826dc5bcc8730da842225a41832d4b9adfc02bbfcf2e8a6605c3aa85e491904fc433381", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656890, "uuid": "6e7b94f9-e4f6-4680-96c9-fc7556edfd3e", "value": "T10CB522D12E7501E9F041CAB299D62ABF735F3F716CCA0927168536449F7E198E82E328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656890, "uuid": "3402d1c9-1059-43c6-8fdc-89c2247dce89", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656890, "uuid": "492c934f-133b-4f66-83d3-f83aceea2021", "value": "49152:6b5TMrVCET4cNDRlB4/BpPh5hzuFNokVpeCnq:6b5TMR+g+zh5hK3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766656890, "uuid": "49c2f4ba-e2b8-4d21-a970-c78a8172e6cd", "value": 2347008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766656890, "uuid": "12e42172-b6e1-4c73-a13b-8191852ea5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656890, "uuid": "199a32e5-4924-4ab1-b5e7-09d742d6bc16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f396dbc-e19c-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766672298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672298, "uuid": "1af2caa6-22dd-46ca-afcf-3afb7abe0f13", "comment": "Malware payload (AgentTesla)", "value": "395ebb53b2f36870f1c858cd2f32fd5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672298, "uuid": "88c4f753-4782-4b35-a027-e189717e376c", "comment": "Malware payload (AgentTesla)", "value": "6e459ba640f69bf42a9cb737f881a1b563caae8aa33ec7b73e0d1c33b6a416c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672298, "uuid": "60447097-5acc-4485-b572-4f4c895a769d", "comment": "Malware payload (AgentTesla)", "value": "392c743eb766e38c970562f89a9a1c5d2e5aca70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672298, "uuid": "8e148f79-630d-420a-8d94-8b5c7054bad1", "comment": "Malware payload (AgentTesla)", "value": "95c67a32f85f3fd0a4729a323bdaa038774984f82b90d9cda78e36408f7d150dea41b37440f8a8dd93538c1ae65d9a95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672298, "uuid": "6d07b5dc-ef28-4917-8169-681517b2d5e1", "value": "T163153355AA9F9DFE853C82B8146F6F0C47348F24885FD1C3FA70A1D31A6DA91C70A9E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672298, "uuid": "03cbb8c0-9b19-456c-bd1e-c24c1ad3f0c6", "value": "12288:alxKC0qhT2mHEniJly36Sl2lbqcYfmcWMQrfpmylXcWDHT4xAFyF+uu4Wp5KouI6:aGfhjni7KyFqEf9HT46FzV4Wpp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672298, "uuid": "33eda124-c02f-440b-b487-a85a79c111cd", "value": 935957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672298, "uuid": "b72d469b-39e1-44fe-b2b0-d51dbb1088d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672298, "uuid": "9837c2be-0c16-4db7-9596-57ff72dbfaae", "value": "Y1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c82d279-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626122, "uuid": "746d3178-3803-40cb-abfc-4278ca7c4b87", "comment": "Malware payload (Mirai)", "value": "22be906f887dc40611731c0f72e71b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626122, "uuid": "d6f96b17-ef94-4477-a463-0240313f03b7", "comment": "Malware payload (Mirai)", "value": "6e4cec4872ad7712b3e1cb434be6d3c064bbe79b1b010aa8d3a79e5d4a1fd872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626122, "uuid": "574bad16-c7e8-4c04-a07b-4701c0c0b956", "comment": "Malware payload (Mirai)", "value": "1bfb29c017ec7c4c2cf8f3d1835aa127a8f52143", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626122, "uuid": "4466b7a5-cc24-4a60-ad6b-0285c6db8051", "comment": "Malware payload (Mirai)", "value": "d3979e465c1dad23413403d1ae97503891e7c85fe14281688d0519417777dd80f08f8d909fea842a4d0611ee861021da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626122, "uuid": "11e77897-d3f0-46be-a166-0f31cf85269a", "value": "T13D639409BF610F73DCABCC3709AA2B0539DCA55721BA7B26B930D518B50B25F19D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626122, "uuid": "5ef5e310-733b-4bef-8571-79bff566064e", "value": "1536:oln3Zm7rtlfSNIXbt9jgEk0ki/ZZ/1lxrq:oln3ZAlfS6yi/1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626122, "uuid": "67b6cd2f-b4b3-4b94-8487-4e99f4c838d0", "value": 72020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626122, "uuid": "1510f1ee-33e7-4a88-b27a-19a4f4d97834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626122, "uuid": "1eee0a42-c2b2-4614-bed0-23a2de3b8492", "value": "0.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7150bc8a-e1c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766688568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688568, "uuid": "86afa58a-22c8-495a-814b-e78ca86da8e2", "comment": "Malware payload", "value": "4123a8b734f9da0e001d6c3654f7323d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688568, "uuid": "86b5bb74-1398-4d20-b492-f20e302e8be1", "comment": "Malware payload", "value": "6f9308dd804dff51901fac87c5b21d47ce752ce16c8889e639b6a40eb968b945", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688568, "uuid": "51f9d86d-427b-4ca1-bb60-8cf51ba4f540", "comment": "Malware payload", "value": "bc74c53fed61a2200ab64f9c8e42f152260be010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688568, "uuid": "cfa8a0e8-4ae7-44a1-87e2-9672fcacb50e", "comment": "Malware payload", "value": "45ee6f20abfbbe903885bcc8fd868ee3a3a66984c246453d067aa8e1031b11909a1be4ffd26317986bf050a9a6236bf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688568, "uuid": "64d3ce1c-2867-418f-a8a8-c14148927467", "value": "T1E2565B07EC9555E9C0AAE6308662D253BB717C496B3123D32F60F3786F76BD0AA79340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688568, "uuid": "6b6ab8c9-f365-46a3-a873-8a1b972ad02c", "value": "49152:TE9CjhgCkZEytt0hhzTFAAJroWCPUJdFiDuLSKVr0kLxiwuI8ere/QLmkimyjFPw:TE4Vy68PEuKJ0kt4YeZ5cEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688568, "uuid": "7d97bb45-4932-4878-86cc-3ba217347938", "value": 5910712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688568, "uuid": "1ba3b5e6-c3bb-4262-aa31-afa957db12e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688568, "uuid": "2871a4bd-a199-4924-8027-8bf786f4da21", "value": "app2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f602b723-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626085, "uuid": "c7e8592b-a7e3-4420-915c-a34e3ddf2451", "comment": "Malware payload (Mirai)", "value": "bbff5d6074e26120d2840f15e66d372e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626085, "uuid": "0dbdea0e-500f-4d3a-ac7c-9fc8b9098b93", "comment": "Malware payload (Mirai)", "value": "6fd0828213c37d50ac3d1a6d8efc2ad581887f4234c9d3a982d32b6eb72de3cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626085, "uuid": "f321dcdd-9e56-4043-a7cd-8a06bd21ae78", "comment": "Malware payload (Mirai)", "value": "961abef598f62bbd8f9d0c731994533f083b25c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626085, "uuid": "340e13b4-da9d-4a7c-a144-6bb3373c1288", "comment": "Malware payload (Mirai)", "value": "fd75bc7cb77157f303d0fd1d2c130eac27082ccbab859c60c43cd609f0f65db8069ca8df01101720bb69ed44a4b227af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626085, "uuid": "0759fa35-70e5-4ebc-a645-cff183bd6532", "value": "T1C8535AC4A653E4F4EC190670207BFB375F37F5751028E683E3A0A632BD52742AA572AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626085, "uuid": "7c0e6ae4-2d45-4cda-9100-c84e9d2d97a4", "value": "1536:VkdrfmYJLUCqBAuzvba516DZAiuqQbdypZdxR5jKB:qJfmCL7qiARLurxyXXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626085, "uuid": "eb26b54e-0c91-46e8-afe8-83c13a5baa95", "value": 66512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626085, "uuid": "f62bf115-5154-44df-8536-3edb07b0b4ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626085, "uuid": "be3bd5eb-0f91-4f50-a337-c4327d394af5", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d7af6d-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766666534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666534, "uuid": "8ec76bd4-91b1-4d6e-a6a7-dd1e55f89c5e", "comment": "Malware payload (AsyncRAT)", "value": "180214c3af21ab5700c606caf8eb34ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666534, "uuid": "2c8ba8f7-27fd-442f-ac51-3c325ab061b1", "comment": "Malware payload (AsyncRAT)", "value": "7112bd84ffe8353db61de08ffc84184f672577553d47882a0f5d7ace9ca204c8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666534, "uuid": "57813395-9803-46df-be0d-ce502b6b3b46", "comment": "Malware payload (AsyncRAT)", "value": "287e98e9ef8843e15cd38192cd851dd58b7fa165", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666534, "uuid": "780c6993-e4d2-4efe-a28e-79fcd88c9ab4", "comment": "Malware payload (AsyncRAT)", "value": "f917b33e289c5a114f632d95c8429ef0d426de271543136a295ddf0e4f5167cba7170cfd567f9631eb13eb74ec585a9e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666534, "uuid": "b295e983-4393-4b04-bab6-14fece25c805", "value": "T1E4C02B209E46023D454ECD2F7CEFC213A43F104AB2104062E63FE406084C14FC77E306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666534, "uuid": "e96beff0-c111-4f20-a59f-ac6be5ab8720", "value": "3:mKDDGKSSJJFItGQqPJH0cVERAIrF7FDzPVRRHSXpGXIKuvxQH1MFmQnovn:hSG80QO0cbUFD7ypGYrY1MFmQovn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666534, "uuid": "0b3260b1-f2d4-4bd3-9644-8caad09f05b0", "value": 143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666534, "uuid": "56ea87f3-1fb7-4ac5-b827-bd16b806ab4f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666534, "uuid": "e06a2b45-a68b-4a23-b7ac-0dc2ed25377b", "value": "t.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9eac48-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766694033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694033, "uuid": "3a19cc4b-6096-4354-a5e7-73149bc4b83b", "comment": "Malware payload", "value": "732f825ee50cd00700ad6dbadbe4e5e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694033, "uuid": "1596c1c8-e14b-492e-ace5-a0e079b5fa1d", "comment": "Malware payload", "value": "7147d8388bfdb4045c4bb9f7f9e9e5b13e43fe6b3936f870d8c47dceb57f6d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694033, "uuid": "c3944b84-c12c-4461-8108-920904137711", "comment": "Malware payload", "value": "9113ce6230bc9b3a3ade2ba1543995b7eb551b2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694033, "uuid": "b1ce4d88-654a-4c1d-bc6b-afba12cc7ef1", "comment": "Malware payload", "value": "b5e3f459b581316f54d1e6cdfce769071ea00ede674f745a22d99201583cc3d2aa17c45f07d847e00ac0d6583634b921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694033, "uuid": "91dc5dc9-b121-42f8-be6d-23fe74bd419a", "value": "T10C531B1AB35364ECC62AD57486EFAB33B671BC634630AF3F02E4E6702E11E601E5E515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694033, "uuid": "d80352db-6527-4622-bf8f-0a1ee90e5f48", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694033, "uuid": "0a150f0f-d832-4367-ba5e-5326f7707f88", "value": "768:y5oPCAeG58IK4PCVzM5S01Qu0hsewzRxUsUlmPX6puv/1bDeI4t0gOiATWhea:yoSzI9HHKrKcPl06Ev/s0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694033, "uuid": "508fc170-b35e-4ef0-b549-b7ab52582788", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694033, "uuid": "cce0ecda-e61e-495c-b2ad-09485f25d935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694033, "uuid": "946b2779-5c2a-4c3e-b05e-bc74d32a5184", "value": "SecuriteInfo.com.FileRepMalware.51353619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb405b9-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766694035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694035, "uuid": "c384b467-1423-4366-8f2f-deb93818c3c4", "comment": "Malware payload", "value": "c7428deaa315b172cc6974c408102fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694035, "uuid": "009160c1-45a5-4421-8ffd-3e7b886c5c2b", "comment": "Malware payload", "value": "719d24ca87b03a132fc6934c29419074fff641db34991a00d370ddd5432eff51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694035, "uuid": "4f4dde1f-f93a-4147-bd56-7d7154a22ed3", "comment": "Malware payload", "value": "950ce179119fbe5d4edf777bf8085390066cb00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694035, "uuid": "7203c711-541a-40cb-b3df-0fe86649ed7c", "comment": "Malware payload", "value": "91528a83418b26dfaaa15f72dcc347311698dff1a7ccd2e711c485e9d2435ee3981cf0a6efceef5d4d65e63704178de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694035, "uuid": "d1499f4f-93dc-449c-8a9d-539c0f1a8f92", "value": "T152531B1AB35364ECC62AD57486EFAB33B671BC634630AF3F02E4E6702E11E601E5E515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694035, "uuid": "14cc18cb-73a5-40d4-9bcf-1a54e2204e7d", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694035, "uuid": "9904e824-a9c2-4088-9462-7da5e29e7591", "value": "768:15oPCAeG58IK4PCVzM5S01Qu0hsewzRxUsUlmPX6puv/1bDeI4t0gOiATWhea:DoSzI9HHKrKcPl06Ev/s0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694035, "uuid": "c2000bc0-6cc9-473b-8e91-544bfe3248ff", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694035, "uuid": "fce36d87-ea7c-4736-9429-f42667c1ca51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694035, "uuid": "da601e6d-0c50-4713-8878-f1a86c34c461", "value": "SecuriteInfo.com.FileRepMalware.98337239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60920c9c-e199-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766670931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670931, "uuid": "dbed8775-29d4-493d-8911-85cdd21ac602", "comment": "Malware payload (Mirai)", "value": "3a902322ec8411f40909da93bfeec38b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670931, "uuid": "0af79c20-e4aa-4c44-894e-7479590223a5", "comment": "Malware payload (Mirai)", "value": "71c01dc2b31d88b1c608b099d991d9ddc103ed193240b6838c4c0e9bf8c880e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670931, "uuid": "7618d1ef-0b75-4f68-9f13-75afa4bbc48b", "comment": "Malware payload (Mirai)", "value": "3aa5c0af320b226785411cc88f3a1b7483451302", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670931, "uuid": "dcdddcf3-160d-4634-ad13-a7ddb711983f", "comment": "Malware payload (Mirai)", "value": "f0c09605c73a6a6934573c7fb8d4fbd50e0bd6e1dde4f4cf233073393972923cdb7f3fb0c70ca4015455de8001b14daf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670931, "uuid": "716f9110-398b-4349-8046-b8737528a02c", "value": "T115934A02B7180A43E1A25BF02A3F17E0D3FEE59022F4FA89290EDA465175E375586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670931, "uuid": "44a250bb-9803-4ebd-b0ac-05f630516dac", "value": "1536:WB8w+E6+7aEi5ZNoWxVe/VSiwanrt4HFP82uc4AKiaIivwnqEfmb:WBJU5bkSQGHF1tKiPiv5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766670931, "uuid": "fc1db5fc-bdca-403e-a3e0-9782c388aa8a", "value": 91868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766670931, "uuid": "1306dce3-8600-4aa2-9dfc-1dec314001b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670931, "uuid": "d9b137d3-2a9c-4e52-af52-e340f325a23f", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125bdfbf-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1766672947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672947, "uuid": "b7364988-4b83-4864-abad-76222ad92e0b", "comment": "Malware payload (DonutLoader)", "value": "9af39cd5c629f0a8859109a07b7cd5b9", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672947, "uuid": "73e8d072-300c-46f3-a2d9-930d7d52d643", "comment": "Malware payload (DonutLoader)", "value": "72b07cce0aeb4d0e40acf7ea039b264c73179299590c375f0df0f95693cc7ed8", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672947, "uuid": "7e086625-51c2-4ed0-be9d-da1e3de68e2a", "comment": "Malware payload (DonutLoader)", "value": "1dcfc4c1efc378c0b09bc5b5a297caf8ef672561", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672947, "uuid": "1526fc89-a3bd-41c0-aa8f-3a32ae0f8459", "comment": "Malware payload (DonutLoader)", "value": "c8f35da4a89704c1c69e6423d06184f7e7ea7c59ee9f8e3c42722f78e5b16e073875807879ccbce21ee0141ff0e6b33a", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672947, "uuid": "28adab45-a572-4b28-ad10-bc30fc817b19", "value": "T1DC36A31956E04443E4967EFE7D2A36684D4AAD1B96C728C7303EF4FB315EC48C628D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672947, "uuid": "590ad466-eae0-4429-9055-9b7a934814ba", "value": "98304:DZvXwe69oe/Scee41dXf4mIVK46HYp5WcQfaBnMjztCM:5XxLeOYp8cQfMEYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672947, "uuid": "5871dbe7-0b2b-45f7-8ce6-9c19a090d0ba", "value": 5228062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672947, "uuid": "93040d3b-353c-4701-88b7-1fa81f4b026b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672947, "uuid": "fe3aa012-b274-4275-a0e2-74cd3fff0119", "value": "VESSEL INFORMATION.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a5b9c6-e1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706026, "uuid": "4fdf40b4-5367-4690-9b7d-9d8f1f8c4364", "comment": "Malware payload (Mirai)", "value": "042d1ce46a5c666fbb7d5c3d62ae60cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706026, "uuid": "357a9bd9-75e7-4125-9324-ca0108af2737", "comment": "Malware payload (Mirai)", "value": "72b5b8fd7b6dcd0ffbc188b947a0861b3ad30d11b85f84853a37a51f1f028291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706026, "uuid": "0c90fa75-ecbb-46d4-a533-e5a6edc8a62b", "comment": "Malware payload (Mirai)", "value": "e3e59321612e8d0d5e40d33bde8038a7927b9de1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706026, "uuid": "ee04ed65-6451-44f3-a8c7-d81c576322c4", "comment": "Malware payload (Mirai)", "value": "76ecd9b55a22a61cd07cb5ec5054263920b1349a16a275a6723cef992ee6442dbc7c325d90d341fd5ac9a7217c7574bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706026, "uuid": "b1275437-4d3a-46a0-9abe-6803da54fd4a", "value": "T1F5A3F78ABC819B21C5D522BEFE1E518D335357B8E3EF7202DD245B25678A82B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706026, "uuid": "d5aae130-ae7a-46a1-8460-6cd519c1f4c4", "value": "3072:q/0gYlJAoClSGJac9OmTBleujEvv7Ex/SqT28:q/0llJPAaGOmTBleuQvv7u/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706026, "uuid": "e5d4770b-0e62-4015-aaed-b218e1167ad6", "value": 105088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706026, "uuid": "3433a888-2c6a-46fd-976f-797a48b29cc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706026, "uuid": "f9a5846d-7ede-49de-b9e2-d45a7b9d3cff", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254f81a4-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700896, "uuid": "27d43a8b-83a2-49da-aa19-a3c90a222f1a", "comment": "Malware payload (Mirai)", "value": "2472379d163aa13922c4813906f78f05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700896, "uuid": "2f9617ee-281a-4b4d-ab82-5041564d5198", "comment": "Malware payload (Mirai)", "value": "72db02328002e64372d2eb1b297e3c8a391585a31aed1954b3fcff6d90fbfab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700896, "uuid": "d48f522d-9e56-4554-8d00-6036f139af10", "comment": "Malware payload (Mirai)", "value": "8ef93cd5fa26ee58426feafa676db34117d33c7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700896, "uuid": "8899cda6-65ee-4a43-b25c-be540ceaeff8", "comment": "Malware payload (Mirai)", "value": "7b421c55e4ff343975af134418a45f5c754b1d56cf51010b03d4d046bc55ca1a9d7bfdcbf93372f3b319c9e21e8b7ff3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700896, "uuid": "0ea6195c-2739-42f2-bf18-eff8372a0f0e", "value": "T17DF3FA0A7B150EFBE89BCC3F05B8270524CC585B22E9BB3AB934D518B54B15B5BE3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700896, "uuid": "ef77c4fe-c2d8-442e-b16a-e62ab6790856", "value": "3072:vc144Z7JdcJ2MDo2MlKDH+UKRFNlTmzRxWttSvuCMbhWK:vca4Z7JdcJ1c1l6H+1ToRMPSvuCPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700896, "uuid": "cf83582c-615d-4ac0-8620-c374de1e6e01", "value": 170076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700896, "uuid": "82e2bc07-c0e3-4da5-843f-227f07f643e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700896, "uuid": "d01914e5-ddf4-4ed6-902f-2927ff548c19", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668490a9-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766666646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666646, "uuid": "832b7987-c8c7-433e-b5d8-9a46248a3e32", "comment": "Malware payload (AsyncRAT)", "value": "7525881260a853a7b9c27802ce058feb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666646, "uuid": "b556ce30-3355-4b92-914d-2a8ac4202301", "comment": "Malware payload (AsyncRAT)", "value": "731487a4cb9733ec62c3df861d44e39ddac523450f9b1d7523902b650c37ab9c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666646, "uuid": "5fcb0792-32aa-4b99-aa95-5c97ff59ddd7", "comment": "Malware payload (AsyncRAT)", "value": "4f955c5a7f9eeb79f8cf2eb924ffc46c68097bfc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666646, "uuid": "85e446d7-19e2-498d-b8ba-8bcccdd5d68a", "comment": "Malware payload (AsyncRAT)", "value": "e0b6b11e15644bc45df81c8beb6a56e342c2b4d51c47c6d329b92266c6be134f5a53bcb9f9726db53ad0a662dba1ea23", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666646, "uuid": "065789cd-49de-4eba-a13a-ac914dc2d506", "value": "T15D26176D67097522FC74DB809F77862BBC2032DE66CF4C1D762466C9D7E80602922FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666646, "uuid": "27a131ce-71f5-4537-b5d1-a0648d6bb15f", "value": "192:jaFlJXxCJ1LcjM/mV6nJYS919Upxg5AMUXRh0ig/dqJS3FS2+++++++++++++++i:jUlw7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666646, "uuid": "619eb004-bd62-4cbd-804d-657d7564985d", "value": 4609553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666646, "uuid": "40a8217b-395c-4604-b344-ba2c03395610", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666646, "uuid": "0a9bdb9d-3250-40d1-9bf1-7289e4cf9fc1", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb211b7-e190-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766667064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667064, "uuid": "d099e3ef-8b48-42d4-8d99-86793f117ef1", "comment": "Malware payload (Mirai)", "value": "f8034777fadbf678e94beb8034675839", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667064, "uuid": "f2a6e23b-763f-4193-84d4-998507967d86", "comment": "Malware payload (Mirai)", "value": "7466d9c8e56e6f9e58f1d969f1d74a7683a3d0d192dbe66bff77a4b9d9ee3c25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667064, "uuid": "7fd14a1c-0122-4acf-bc71-ce8c07141110", "comment": "Malware payload (Mirai)", "value": "23ed8ef95110870ee9ae1d1363a89415bf361057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766667064, "uuid": "f01a338f-8d9d-41f7-bed6-d301643e971d", "comment": "Malware payload (Mirai)", "value": "a3eef7b7eae5e95a6bc92934220881be389faa035465865d8b845c60efdeef1d0cd30f82852e07100ac69d35dc420810", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667064, "uuid": "0a998efa-28d6-4663-b9c2-52c57af7e40b", "value": "T16AB3C419BF650FF7EC6FCC374AE9170525CC691A21A87B397934D918F64A24B0AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667064, "uuid": "c33c9195-67b8-4ee9-84f9-960218d3ad99", "value": "1536:UnmwZGZr5gbD+IDbEaDH8q+WIcUYT4pB2IIkOGPIbfTeZmpmbjEecTd:CmwZGZr5ENEaDnHR74IbreJMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766667064, "uuid": "845cd4e8-3e47-463b-9b1d-52f078fabde1", "value": 113572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766667064, "uuid": "dee33cca-6994-419c-b075-13ec7ea18696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766667064, "uuid": "a911c9f5-23f9-445a-b77a-b44049ab2e5a", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c58252-e189-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766664309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664309, "uuid": "513b924a-3a80-4669-a4a6-a244a9fa7583", "comment": "Malware payload (AdaptixC2)", "value": "23be339b732b225ca0ea89c57d93a60e", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664309, "uuid": "98d2560d-2739-402f-b73c-72cdde0de1b6", "comment": "Malware payload (AdaptixC2)", "value": "750f49cba0d3346f01a134285100b17de635e703306ecd2c808f93edef404741", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664309, "uuid": "55b54c2e-0a27-4d29-96c8-3ec8e3af4392", "comment": "Malware payload (AdaptixC2)", "value": "28c3e1a2e0ee5f93b8805535ad5ec2a242021643", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664309, "uuid": "fa017c9c-e9f8-4e3b-9b76-22e503984df2", "comment": "Malware payload (AdaptixC2)", "value": "915f1c5d96b9e422e7e5024889e58032828b3418fa2b6ed58879e73627b354fa8fe5453a891164bef472ab79772894dd", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664309, "uuid": "ea616df9-a49e-4146-b1b3-9e0fdc68ec33", "value": "T1F8836736E6B3C4ADC06FD534AF43A4B279F17C1C4634661947C1A6223B6BD386BBE640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664309, "uuid": "89646fe7-f8ce-40d5-b196-74794eb3a9c4", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664309, "uuid": "a701b1b2-6bad-4deb-a8f3-a1578b708a3d", "value": "1536:N7mVGS0CFTvMLWls/QwJbguY++6CchVgsXwbFoqk3yGoFA9+a:NqVI7Xhu66qB3Doi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664309, "uuid": "e6b0acf9-0c20-4456-a7fa-cff09e5ca370", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664309, "uuid": "8c155151-9219-482a-a5bb-bcf9fb5d28d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664309, "uuid": "16a44bb8-662f-4e0f-b446-8cc3f6d54edf", "value": "23be339b732b225ca0ea89c57d93a60e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbc47e7-e1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766705390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705390, "uuid": "b6751409-687a-4dc8-a21c-80f9c201c5a7", "comment": "Malware payload (AgentTesla)", "value": "7034e0771068b8bb356fb577f7d5b488", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705390, "uuid": "be94d539-8c49-4902-9948-81d650f3736f", "comment": "Malware payload (AgentTesla)", "value": "75b4178ee21ff11489361b9f2230138f3b93e46c56c2527d17074d5a031b6cf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705390, "uuid": "15939743-69a7-4d8d-99c7-17a8edb6b85c", "comment": "Malware payload (AgentTesla)", "value": "a4531130c37cdadbbe4e916366162380c2facfe2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705390, "uuid": "b22c1159-91c7-4d02-91a8-c9add6268e00", "comment": "Malware payload (AgentTesla)", "value": "ccebccddcf2cfc18b00cf1e89e772bebd582f49216a896ab209104c88ddf0445a5f2d041caa03fba3b707b6c367ef131", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705390, "uuid": "133e9b85-3db4-4e18-b812-75b0215b7b8c", "value": "T1A4D422A69AC19945D1506371C83ACCA148B83A319E58673F872CF62B7C313C3EE63B5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705390, "uuid": "528c4f90-ab8f-4bd2-96f6-6b700fe1b627", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705390, "uuid": "8691dc8a-d995-4fd3-87a0-e48863b791c1", "value": "12288:sz7hU5I5yuNHIgzSFKxWltRohBfSTso93Uy/isuYaFnruAZxdWe:sf+iN57Gtene3HBXaJaAZ3We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705390, "uuid": "368c5e31-3840-4eb0-a43c-b52c298a653d", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705390, "uuid": "61fe0184-cdbf-4228-bc1b-a792181f1a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705390, "uuid": "6281005a-60c0-45b2-8f6c-618a804c5d6e", "value": "IMG4567890008765434567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e63ed41-e164-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766648137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648137, "uuid": "10d90d13-acd6-43d1-9194-04044cd5baae", "comment": "Malware payload (Mirai)", "value": "a27022e70b526548eccf6f1f8f2df0d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648137, "uuid": "ce8b72e2-0c76-48bb-8ccd-f183b760ba3f", "comment": "Malware payload (Mirai)", "value": "764d5dce1bd17714f699e1dc979d49909836f1dd44f1f305a38fc49fe8c05a4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648137, "uuid": "4c172388-70e5-494f-bbfc-aca9460d2500", "comment": "Malware payload (Mirai)", "value": "1de9f9d6ef0f51893b4edaf12db3db520779f2b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648137, "uuid": "172dd663-2353-42c9-8219-db66ed153933", "comment": "Malware payload (Mirai)", "value": "01b38690553914d4269d375928ef42bf50c2811f5d8b46c2f2e28a974b5cca99309d485d9dbd370f2389a11260dc1dc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648137, "uuid": "5044c39c-7196-433b-be26-357de440f4f2", "value": "T144933ADAF401CDBDF84BDB7B8463090AB931A75115830F3A22ABFDA76C321954D53E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648137, "uuid": "8930ee81-5d75-430d-b292-f2e6075ad079", "value": "1536:eVrOOTBG4fv3gs3v1bxN/QuzQ0zXf2/QT8cxAEQBgk+EYaD4TDHJRJhRH6:0I4f/P3v1tK2Xf2/QiEzE9DuzRH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766648137, "uuid": "b778dc18-dde1-4574-bebf-a35c76503efa", "value": 89356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766648137, "uuid": "0e6bd504-8ff9-440a-acb2-1d7cbaaa4ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648137, "uuid": "371adc66-39d1-4e82-8d2b-8af042416798", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28145aa0-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672984, "uuid": "d898793d-6fbf-45c7-bdc8-b66dcb66c15d", "comment": "Malware payload", "value": "133347a9d4ff90de358b5939a667f9fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672984, "uuid": "b5d3b438-dccb-4dac-9421-78726c1c139a", "comment": "Malware payload", "value": "7726376e318b7aaa69d0d9d7d05bff2fa0f54497eb478a05be97a0b288d041f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672984, "uuid": "f7e2c008-ef20-4b1a-8f08-a25107de7748", "comment": "Malware payload", "value": "e64a79cf950f61ed7c322715b5d850b6d43ff437", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672984, "uuid": "5c6b4260-5ef5-4371-a64e-3362c4da97a8", "comment": "Malware payload", "value": "d0819e5ff282f3cfb4bfe1f27bc4b84c94bf1a087d7ea326626992be9c5ac4ee818099affa095f80d582d71c771c1d1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672984, "uuid": "b156ac03-9b9a-45c2-a430-457aaec19ed8", "value": "T1A5D43BEC31ADB6265EE342F5106F1507B2782823580C8860F121EDBD37B999951BBFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672984, "uuid": "9625f28c-a026-4d67-acb7-5f20eef29625", "value": "6144:T69o4f0ENXYoFTwiZ+N30pzozzGql4erLnQEsDFx6FuPuuNp1m8LcgigN2kI/:mZfxNXm930pzoZlzo7IFudN+9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672984, "uuid": "2d0f4d71-6cc4-453d-9ec9-92c8c4953d21", "value": 612349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672984, "uuid": "17f0b221-567b-464e-8db2-80d23f5e0e7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672984, "uuid": "767fffd0-ee98-450b-810c-273d320ac5fd", "value": "json.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae57db3-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766665204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665204, "uuid": "e59ac09d-37c1-4d81-973a-37d790fa41f7", "comment": "Malware payload (CoinMiner)", "value": "08b2c11f42f2f1ab48b5c779cbe3264e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665204, "uuid": "10d0ba2e-913b-4d65-9f06-fdbca28c3c45", "comment": "Malware payload (CoinMiner)", "value": "792b4b69b7dd3e1205a56ff0fb8b6b98ca040b5cdeda9b772563e6bd033d5e13", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665204, "uuid": "024df763-e396-4ac6-b99d-c1dac8755b20", "comment": "Malware payload (CoinMiner)", "value": "b67d36c941cb15f88dd4e26e75aa5eb021d9935e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665204, "uuid": "eabcab0e-bd93-47fc-b49e-5a8016a6109b", "comment": "Malware payload (CoinMiner)", "value": "2fa9e2026985bef4cd884ead17a468ec76e8dfd36621cc8114d6de753033251627612adc472f0587ff5382f0bd9ed30a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665204, "uuid": "1a4ed1dd-6063-4589-9084-a72c3b9c2600", "value": "T1E7E54B1BE5E250FCC1DAD074476F9623BA71B8A942247EBB2294AB702F63F50631DF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665204, "uuid": "fc52664c-5bff-446d-938e-867d9f661310", "value": "98304:7G/sdlVlNUxipb29DvYmuyC4DFrocApvlfPE1o1EchItUi3rg+ArImHnidrZW:Zlh1GtUi3r+JCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665204, "uuid": "ce6b2579-8edb-440f-8893-b2ec62e1f691", "value": 3163021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665204, "uuid": "81e5822f-dbd4-4d8e-9153-18bf42c69a8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665204, "uuid": "a1f368f8-ee45-4426-ae73-d5d777ed3460", "value": "xmrigMiner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15596da2-e1bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766685837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685837, "uuid": "fbfeed3e-980c-4eed-98de-f8141c23bddc", "comment": "Malware payload (Mirai)", "value": "54cef8ccd6ec1f3c9462d21df5ffd9e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685837, "uuid": "389b284d-fb23-464d-81d1-f2bc9033c2b9", "comment": "Malware payload (Mirai)", "value": "798684b820f085eae0c1a81204d34bb10f151ddaf6e2064e61dcd2f83c77918e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685837, "uuid": "812a120f-534e-43e9-8cef-97dbff899209", "comment": "Malware payload (Mirai)", "value": "90a5de0df310ac78d8ab828d60985fa5012eb1e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685837, "uuid": "5ab26da4-b63e-4cef-9dd7-6d32ef91e28a", "comment": "Malware payload (Mirai)", "value": "3da46035dd6a420eda796821a81359b4d4a38700b63984b55c2db5b0f571c6e254b5eddeee9c2f5842fc1271c7a4024a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685837, "uuid": "eeb47d17-2e13-41ab-8f96-8d918ce3493f", "value": "T1E0739E73C92A7D50D8984974A8A49F7D2763E01142271FF659E6C2AA4043EFCF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685837, "uuid": "00d2b3a2-4025-4246-89d2-dcc5f0f3fa50", "value": "1536:T/ueRpcayiPCdwtAoFBo7t4CqNxMbCKV8AQViMZCVXC:T2weMS3oqteCblV2iMZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766685837, "uuid": "cee79865-82be-48ca-8917-ab4eefc08a5b", "value": 76488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766685837, "uuid": "44b936ca-9161-4969-b87d-77f628698843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685837, "uuid": "444f73e2-c879-4b2b-9210-507c8a4530bc", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4d8dcd-e1ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706542, "uuid": "2cad3e1a-a234-435e-9133-26b66552a34c", "comment": "Malware payload (Mirai)", "value": "45c1cfeb8541dc1f9309c8b264d4fda8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706542, "uuid": "596567e1-f389-418e-bebe-9310da4c0aff", "comment": "Malware payload (Mirai)", "value": "7ab2c12e0322e7ca383c1a210d33437e3f8089c0d6f31711a5180fe3348b1cc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706542, "uuid": "7620ede3-068c-40cb-a598-973d76a79ab2", "comment": "Malware payload (Mirai)", "value": "fe8593319bffc9613c4dfd4d8e833323e88757ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706542, "uuid": "4a8c6b6c-5153-4b95-b7fa-de543f7457de", "comment": "Malware payload (Mirai)", "value": "8e602b43cdc73c7990b9d6269cdc25961013a48d4a4bd58b879ddf5833948ff2ea16d964799ae9844589bb912bc61af9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706542, "uuid": "3fecfec8-4e08-4e67-a115-31ce3f99f029", "value": "T1EA83E849BB614EBBD86FCC3341BD4B4535DC924322A83B7A3974D418F25A24F4AD38B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706542, "uuid": "acf267aa-b64e-4658-bbdb-b2ce77bf5f96", "value": "1536:kAvMzxdnB94HKuU8ANMcZGYRBJN45+Hd4D81LB/T2bVR:kp/4Q711LlT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706542, "uuid": "ead38313-3269-443b-b759-d69eb1651cba", "value": 80740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706542, "uuid": "3b2bc768-c3c7-427c-ac94-190560680c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706542, "uuid": "f4da537c-602d-45a4-82ff-5bbed5033612", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b18e26e-e17e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766659218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659218, "uuid": "aa78d40e-ec54-41f1-95e6-936b5d044b81", "comment": "Malware payload (Mirai)", "value": "3b7a9d6d155decb647934adfe07754ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659218, "uuid": "867a8060-4de6-4fca-a1c8-4ad86ced8856", "comment": "Malware payload (Mirai)", "value": "7bb4512d4f18636025c530b907453de8a24cde56e6aa3d75a971f018fb4a5694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659218, "uuid": "cb273b96-1fa4-470d-b8c4-ec9fea7c27f0", "comment": "Malware payload (Mirai)", "value": "bcbee7bc2f6079bb0a50dc685885583c5c5610a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659218, "uuid": "f221f8db-ce05-4af6-98c6-768249fcab8c", "comment": "Malware payload (Mirai)", "value": "53628fdd6139fc66488879237d23ca12d3fba6a0f4265bec04bd34b5047f220573de041f327d6e3485dc1d6b70b7f08f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659218, "uuid": "6a969bcf-a853-4970-b9ac-76f0e2b4d6fd", "value": "T174A35BD6F401CEBDF84BE67A8417090AF530E3511A930F3A626BFC636D321994D67E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659218, "uuid": "f754064e-8546-4b0e-a098-b6174e9ae6f0", "value": "1536:5sLjGezxDxIsU1AkU45MmBoQFc7YjuSdf58pxWsHGheQNDXt2O04b2SDTg:G5xIsyAxSoSeyuSdfbFNjthHTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766659218, "uuid": "34d653fe-e2af-4b78-999d-ddafb3c866b8", "value": 98520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766659218, "uuid": "f7ed8506-7e69-4477-b6e9-8ecf3ba20928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659218, "uuid": "0a96e818-bcf6-4b00-8f8d-f6054ad140a7", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38a0f30-e1ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706718, "uuid": "d0363527-9b4a-4715-9469-11fa8fe6121c", "comment": "Malware payload (Mirai)", "value": "11f62dd16220800d830bc6909acd8f62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706718, "uuid": "3137b856-d71d-4d23-90c8-3c1369b220d0", "comment": "Malware payload (Mirai)", "value": "7c63c4d48eda58e7006eeb8d963ed88a37ae44e8723d19e5a094f57530873249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706718, "uuid": "ad203f2a-d19c-40ee-8d1f-ad21e745ca84", "comment": "Malware payload (Mirai)", "value": "a01b950e09d8787dd4588eb4e8e3fe66fdacab9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706718, "uuid": "a9ef3964-f349-4a57-ad5e-ba77204540c3", "comment": "Malware payload (Mirai)", "value": "6346621cb014cb6ef80c4c02db8825579aeac52ed102b5a39660e62204030a8194943142143dd593e842a01a8d1d6eff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706718, "uuid": "7a1bdadd-ed09-4e71-8147-1098b268732c", "value": "T1FD331784B8858A16C9D4227FFA2F419C372623B8E2EF7217DD126F15778982F0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706718, "uuid": "d81bf6ed-4579-45c6-981e-8c8c645626f4", "value": "1536:MJjGWe2uGO5dQhj9yWnBg7wKOkhm639T:MJ6FyfKTm639T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706718, "uuid": "74864516-efb1-4627-a787-cdabf6e1ea6e", "value": 51880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706718, "uuid": "d4421144-bf10-4556-8bda-15c1e592104d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706718, "uuid": "06f6bde6-7caa-4940-a026-50253f6b9c28", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d64b8a-e184-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766661966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766661966, "uuid": "0527f75c-09bb-4e10-8002-f1e5b9d52280", "comment": "Malware payload", "value": "fec56ce94a9b2278fbdc92c53b1b892a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766661966, "uuid": "b6ab65d6-ef05-4800-8c9f-44c6bf0d5362", "comment": "Malware payload", "value": "7c82e966c458ed5be7ff7a727e73720968cd6d26eed382aa1f62cce6933399d0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766661966, "uuid": "16b5ec42-ea04-40bf-9829-929dfbbb6457", "comment": "Malware payload", "value": "1110e520cce60dfd2986211194dd7a78594085ad", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766661966, "uuid": "c4ec3875-fcb3-4b0d-bc22-5feab28f01e4", "comment": "Malware payload", "value": "6abc0646439b4e249a1ed83af10563c25b9c700bd1f179ab43b965148d46dde43131971f0a5e220fe483965bd4e3202c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766661966, "uuid": "53ee5868-235e-4514-8b62-8d89b34d9357", "value": "T1A81533922844CD37E406733015D45E92FB3E8DB9964FACAB312D368E50B350BB535BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766661966, "uuid": "c238ab4b-8888-4816-9e17-3751bc127b48", "value": "24576:YOvZCDSonOnMJBDgMuqNUyrRVkTVXkVC:joFJBL1V+0VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766661966, "uuid": "ab99a3ca-7d8e-4465-8f75-cadbe326a3ec", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766661966, "uuid": "eaba136e-74ad-4fcd-87d7-d6e0e6f18577", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766661966, "uuid": "45595a9a-4cdf-4fc1-ab4b-af0b437453ef", "value": "ms.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef67f95d-e189-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766664299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664299, "uuid": "80d3d8ae-2600-4a8c-8998-813b811e185f", "comment": "Malware payload (AdaptixC2)", "value": "0b9cfeb38d4cb7fba777ca52faebc52c", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664299, "uuid": "0e4dd213-d8ad-4a48-a254-0c03c894c7c6", "comment": "Malware payload (AdaptixC2)", "value": "7c9fa211fe4e66b6d994c7e511bc4ddb177042298b0e5b39583c804cac6679c2", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664299, "uuid": "71de0ea7-c824-46ee-a0d9-3607dfe553c7", "comment": "Malware payload (AdaptixC2)", "value": "a13f3eecec10667226a1eb93f9a63c299ba9c7d2", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664299, "uuid": "883bca1e-bd30-4336-8d2b-94f22b1e0481", "comment": "Malware payload (AdaptixC2)", "value": "a1bb87e0026fcb30a04ba2e452b0f6edb0a5d8ef61fb8bd080ddae112d42e71eb5ddc70e2495fc749ec5d785866e5d9a", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664299, "uuid": "a81ace7f-4c07-40db-abbd-3599d8d71da2", "value": "T140836536E6B3C4ADC06FD534AF43A4B7B9F17C584534661947C1A6223B2BD386BBE240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664299, "uuid": "22454f8e-96f3-42c2-a486-ce999233f0be", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664299, "uuid": "891b75bd-611c-4f29-875d-b1f184d9ee96", "value": "1536:Yuo3eqVEq/b9IW2BrlP3O3coXxaF0dbVSNm1vBf6RvjrXPaQk2Da:I9QYZZhth8vHXSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664299, "uuid": "b936f97f-9f7b-4e20-8dbb-326d1c0d2bb0", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664299, "uuid": "63d1f30e-99ad-40c4-b1ba-d6eb56865b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664299, "uuid": "05d5a944-5e78-4256-817b-d7d6fde027bd", "value": "0b9cfeb38d4cb7fba777ca52faebc52c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ddb184-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665187, "uuid": "1c6662df-5e44-44b9-b463-bb4a61476804", "comment": "Malware payload (Mirai)", "value": "e9d1562ab6bf53e00d2540abb2c914cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665187, "uuid": "fea33c1d-2c93-4df9-a505-6bdf83e5ff3c", "comment": "Malware payload (Mirai)", "value": "7d36dd5a16b2df5e6fd464c02e8e067ca878fdc24697aa5acf1f9b0c1c7e8413", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665187, "uuid": "764b76ae-ce37-4c33-a44b-56ae1c4e3f50", "comment": "Malware payload (Mirai)", "value": "59fbf4310b3899e90f66360e3e575b65d24463f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665187, "uuid": "e3db7d2d-be84-477c-8f72-01a31023cb11", "comment": "Malware payload (Mirai)", "value": "72390c352c6cc9232f8dba366ec05777edad2497f387a56a9c9b7cb28db6d00232746c1f8c8bf4e8c4aa41e0ccfa0d8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665187, "uuid": "2e9e6ced-14b2-4ecc-87b6-d1d62f683840", "value": "T109735C829842EDF7D85206F416A38B718532F93B251A9993F3AD7DB8AF514C2F00771D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665187, "uuid": "ddc3c1d1-5d1b-4163-936c-10c5010eb7f1", "value": "1536:QQhLgV3QTSpZaKcecB2OEFB+/VUHP7KFM0ADiJt:d+1fB3BIVUj6xGot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665187, "uuid": "f3667c31-2a46-4e98-ab33-c62921ea2db5", "value": 74407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665187, "uuid": "886b826c-847b-49d6-ab99-c14459710ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665187, "uuid": "03bff7d5-0a6e-4001-affc-29cc30df18aa", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6538c315-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666214, "uuid": "16961c6f-74dc-48b0-8a33-e4b27e20d512", "comment": "Malware payload", "value": "2b9dd7d3fd50ec638a45bec6b6b0609c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666214, "uuid": "39caec8f-e78f-40f5-ac4a-bd6fa5168f24", "comment": "Malware payload", "value": "7d6d219df14c3bf33d520b62839b052ca424032415a066b49eaafb7a06c1922a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666214, "uuid": "7a30c0c8-6c75-4a63-bbcb-fc6c480e0864", "comment": "Malware payload", "value": "ef49a1cca019f5f52b963de65b5f0fed30d8ce74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666214, "uuid": "845f717c-56a1-4f4e-8c1d-e4c988499272", "comment": "Malware payload", "value": "08c247b0c45ba7813a8cde12e49fc9ebfa022485750b2c2c284e9e5d1bf34723f5a14b899d14bcec352d724a5e24e055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666214, "uuid": "9793a735-1ff4-4648-b923-795f41c33982", "value": "T18D247E21B4C1C431D577153309F8DFBA5B3DB9211B626ADB67980F7E8F201C2AB3196A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666214, "uuid": "8cd3aee7-689d-4d1a-bbf1-255ada7458b4", "value": "31ba2dcb49ab5d61acfa8dae6ea3c66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666214, "uuid": "1bf26279-695a-4d03-bbff-caaff3ddd2f2", "value": "3072:N9VXUi/M2MjjGnzOy8YU9PIQjGg+nHWulKJAvnZGnp0nGunADb8Hvgvp3mjxM87L:SqSYU9gQVK/GAvnYnOUooIjEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666214, "uuid": "6817e495-5104-4cd3-b2af-64c0fc770dc9", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666214, "uuid": "b0e57a0b-7436-4d43-9eaa-5a533eb68890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666214, "uuid": "005faeb9-7721-4a1a-80ae-4b7a2dee4b4e", "value": "2b9dd7d3fd50ec638a45bec6b6b0609c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d24d038-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626365, "uuid": "118deb0b-a688-40bc-93e7-243099637bfa", "comment": "Malware payload (Mirai)", "value": "718d1872d6f505af6b2a33b77f8fb8b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626365, "uuid": "c6160a67-6eab-4856-a793-df97e38e4a46", "comment": "Malware payload (Mirai)", "value": "7d853b1df98fbb637e4e65659a5ed463a22d4cfe2d2ad76af7779ffa8f8bb54d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626365, "uuid": "8ce0287f-c18d-47bb-9211-352d3bdeca86", "comment": "Malware payload (Mirai)", "value": "184ee9eedbf9495cbc2ef157d7f3eb1df037043b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626365, "uuid": "1b150f80-6dd5-47a7-93ba-9f11829a8128", "comment": "Malware payload (Mirai)", "value": "316fe55e3df8faebdccb000d99b5f17470b70ca0ecb25b90ccd6149d0ee4ea12a888e4809e1ae58771fda72b54efcd89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626365, "uuid": "d7d9d980-a9c8-404f-8f9a-195286aae00d", "value": "T167333B21B9762E17C4D5B8BE61F34724F2F5570A26A8CA5D7CB20E8EFF14A0071136B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626365, "uuid": "547bc013-0775-4d1c-b5c4-ed45d6371b34", "value": "1536:Ym+pS/2d5LNv7pfvKSVWeLBFpYNzZAeeet:DPqpv8YFpkzZAeeet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626365, "uuid": "8c066014-845e-428d-a1ca-35df4b7a1b8a", "value": 53924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626365, "uuid": "490f0a46-e3e3-4826-991e-acf3b8565b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626365, "uuid": "828acbca-ed49-4337-a5e2-16175db328a3", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be12d3c6-e18a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766664645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664645, "uuid": "eaf339df-a9bb-47d6-a0dd-b663d8629b55", "comment": "Malware payload (Mirai)", "value": "facfb727c2f339f39ade5e29a8d48a8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664645, "uuid": "249113ca-366f-4486-acd9-84e701d9f0c4", "comment": "Malware payload (Mirai)", "value": "7dd8c3fe8594bd26a06d0df7438b4c06356b02767c5f246bcca9380549452261", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664645, "uuid": "1900b51b-67b1-4340-a16d-db1c57bb7872", "comment": "Malware payload (Mirai)", "value": "ba0a5e8eec9aaec2d3f3b9e4cf5fdea6139c268a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664645, "uuid": "9c09b2d1-2d25-4db1-bab5-c664388a10b8", "comment": "Malware payload (Mirai)", "value": "c0acae14460b1499d099a91411d52c8b9d7c93af988f22dd896996bf88b73c6ccca7ca969e3b979179c6676792f56f75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664645, "uuid": "f0dc4b19-87ac-4812-a829-cb09d47a1c76", "value": "T1F882D02D5722364AEB00C13D8CCA1B724FA093BE2B456751CE69C07EB69F3171D76496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664645, "uuid": "15e27068-a52d-4d5b-be25-0ca621a60bdd", "value": "384:XzlP55capAbgD5gDtm1DRCuEtCKq2vd63HUYxUCQwQD65hdpC:jL8YdLEtCKq2l633vpQu5/pC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664645, "uuid": "950525c8-0051-47af-bc4f-c7952f767aac", "value": 19160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664645, "uuid": "25f29179-2ed7-48cd-ad82-5e846b97cb44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664645, "uuid": "9b6d7cc7-7176-40e9-90b6-2d24004b6002", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5a8bc3-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766665612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665612, "uuid": "524b21f9-6ec5-4a77-96cb-1bfa2974a36a", "comment": "Malware payload (PureLogsStealer)", "value": "a20549cc494317598f8bc7474709b396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665612, "uuid": "aa818942-0238-47a2-9a34-af2f12f22c7c", "comment": "Malware payload (PureLogsStealer)", "value": "7e938110c3e4158818ed547159cddd4ba70ebf6bd0ee471e5877c2cd00df417f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665612, "uuid": "590824eb-0206-414f-ab70-aff5b4605118", "comment": "Malware payload (PureLogsStealer)", "value": "8a0f8fbc1553ab642f2b1a08a49914d932a243e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665612, "uuid": "47ebd554-0a48-4832-a73c-a48b8a6b3468", "comment": "Malware payload (PureLogsStealer)", "value": "f69f7e55ec710429f76df96917fa58617ad04e7e4748bc59fdd41e98da975f6c908120e0d3df53bcdd5071d2a4c127fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665612, "uuid": "ef0422e6-6a88-45c2-8505-e71e22781931", "value": "T11CF4231C93BFB65CFCA6433C8E633D47069AE6459D236A8B640F5E307B10B5FDA41A48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665612, "uuid": "896da902-f2b7-414e-a4d4-aeb995c9d554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665612, "uuid": "8b152cea-7c9d-4559-9bc7-9e6cdc9339bf", "value": "12288:+4DrSIgJFqqvTVCMExsrmDgxCBVEgcay/1/mzNBVIBg7G3sq3jmSf+yfREXdtZt6:ZWzL34MsokgkV37y/1/mzNByBgS8qTnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665612, "uuid": "f2256eb2-a674-4f9e-aab7-dea22b3f33d8", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665612, "uuid": "55378fbf-20dd-4108-80cf-2bc52310892b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665612, "uuid": "233508a0-402b-40fa-8be9-ac003c8ba5e4", "value": "a20549cc494317598f8bc7474709b396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0412e1d5-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626108, "uuid": "4e09b0d9-8e3a-4a07-8cf1-2a86ffb36cc3", "comment": "Malware payload (Mirai)", "value": "e42828437c8908970a8e0a4bc9988010", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626108, "uuid": "88e80424-c127-471f-bed5-58b456889bb3", "comment": "Malware payload (Mirai)", "value": "7ec507530f696b687d562519d1fecd1a9ebc7d2f60dcc2db7a55760045144bf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626108, "uuid": "19a31940-f3a7-4631-b203-cccb456ec7b8", "comment": "Malware payload (Mirai)", "value": "7eabe87ab04c8b20ebaf7ff23859c6052668f5cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626108, "uuid": "373b19f9-a426-40b0-9a98-1ce1cf1f21f5", "comment": "Malware payload (Mirai)", "value": "cc1894a1cf37b0b9cd6d329b924038ac4273d44158ce2178077a56a4848fbde56a53ddf6bb27b59976fc73dd2340208b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626108, "uuid": "8f5c6d44-1ff5-4490-9088-215008c506aa", "value": "T178332981B8829A13C5D4037AF56E46CD3B2527E8E2CF7217DE215F113AD681F0CAAE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626108, "uuid": "2b693962-79dd-43a2-ab7c-1de4f40d6c3a", "value": "768:lxda+hapaoF1lHj+j47XoVyow7sdZcNVXto+I/oF1mA2EDEy0eYjW9THvmw1cuwT:xa+URj+WXo0owoYo+daSc4kMej3qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626108, "uuid": "47f9a647-bfbb-40ea-b736-3aa0c80b8762", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626108, "uuid": "c1dbde12-e343-4c1f-a85f-71e60df3e430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626108, "uuid": "b93658b2-7694-4738-8cb8-0d76404cdf6b", "value": "0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47332444-e1c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766691504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691504, "uuid": "e52e45a0-a742-4069-bb91-5d3c67387e81", "comment": "Malware payload (Stealc)", "value": "2570aa2d6bec5c5c98e55b776dd39fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691504, "uuid": "775a65d7-a3d0-4ecf-9763-6b105e0dd22c", "comment": "Malware payload (Stealc)", "value": "7f31d970c25ffcbcd85fd512e9456a64ea9ced2312a37f628f1443f133beacf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691504, "uuid": "556dfe59-9b24-4eee-91f6-f2ceb8cc3a9e", "comment": "Malware payload (Stealc)", "value": "9e67cdcede17c12c1b18da6d4e8994ff7c41a3d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691504, "uuid": "38db66ab-d6e8-4269-9f80-3c3e8bec8e20", "comment": "Malware payload (Stealc)", "value": "e4a99e7eeba88d33bcb721167767cf940b962d4c0187b905122e4075b8e6e12ba12c78e5ac096a5fd59b3cdfe604ea8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691504, "uuid": "c0301ce2-df13-48d8-a682-0c746eea8093", "value": "T17BD49D22759194B7E47606358C74EB508BBDBC700F616ACB73C00A9A6E706C1AF37B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691504, "uuid": "c49429db-3d8c-4dd5-86b5-98fe290a00a9", "value": "61a3509ea0647265062ee40711b8de6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691504, "uuid": "8f2fe9ff-b2d3-4cd4-8c31-1b87d8e64d17", "value": "12288:98o4+ZvqdCoD6wIJFDufwpvqiv3YZtF15kjH8MJ:74I+6BJ1uai23OM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691504, "uuid": "0d2121a4-37e3-4214-bd28-7ae17d4cc2a0", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691504, "uuid": "2a447cd5-9c1e-4277-95f2-274788a1539f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691504, "uuid": "6a3df2c2-f91b-46db-a653-670046314da1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f51b98-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641223, "uuid": "ee993194-83a8-42ba-8e91-c86d419c36c1", "comment": "Malware payload (Mirai)", "value": "bb12940b4f6b01373681e302a496c7c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641223, "uuid": "f43878c3-311a-4b33-b3f4-38bcf05229e6", "comment": "Malware payload (Mirai)", "value": "7fe2e6f305e96be293965d2c51c34e1e0fa92b648e31b63524b8dd6bb908c32d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641223, "uuid": "4072809d-92fd-475c-a8a2-87a59250a5fa", "comment": "Malware payload (Mirai)", "value": "12b8fe6773771c2e8e90cbe0e6283d730cdee513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641223, "uuid": "ada09bae-c714-4b25-94fa-5026c98a988c", "comment": "Malware payload (Mirai)", "value": "92f649e5d855ca4d87d46ed9333a196c48ca5ea7045cfebbaf6a3a4aadbe80eae34995cb36cdd62b692362dc7e1c2c1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641223, "uuid": "2e005f0f-c237-4f3a-a817-32a8ce28a9e7", "value": "T11673F745FC819B15D4E522BEFA1E118D336367B8E3EEB112DE101B2577CA92B0E77902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641223, "uuid": "a08ec61d-4c8d-4a9d-b139-d629e8746b2b", "value": "1536:WknoQv9dRYjWXUGu1Z7aNBqB3QzkWWoSb7PAHauRwkTp39l1XibwvNbzisT:BZZDIoSb7PAHauRw8ywvNb2sT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641223, "uuid": "a63b46b4-599d-44de-b942-d3de35b8b2db", "value": 73800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641223, "uuid": "50755dde-8bdc-409c-9cb4-255955557e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641223, "uuid": "ed0e2e3f-3ba9-4e9f-a58d-bb047204f86e", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabb105d-e189-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766664291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664291, "uuid": "8638ef52-d4b1-4848-873d-ccd8620fad27", "comment": "Malware payload (AdaptixC2)", "value": "11609064f34537f722ed00513d9d89ac", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664291, "uuid": "5a0b6c72-22a4-4e4f-90c0-a7dbff09ca53", "comment": "Malware payload (AdaptixC2)", "value": "801477e66d99676b86bc589ba6b49451e6ce98570f13f9204b48d2bc04372b70", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664291, "uuid": "20a234e4-ee1c-4da9-b76d-6f0822f3e60d", "comment": "Malware payload (AdaptixC2)", "value": "9e85420f51104dfc42096e114895fae223459f4a", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664291, "uuid": "6097e719-8b44-4ba9-8c18-cbc875d14777", "comment": "Malware payload (AdaptixC2)", "value": "f42ac13a92b84ca0b703b93c7ac944119ac9ad82082082a458660ee8b11a657d5fd78b497a20649a8477ca5f993884a1", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664291, "uuid": "5464107e-e405-4d4c-b50d-56631df35d12", "value": "T161045236E6B3C46DC05ED634AF83A4B3B9F17C5C4634751947C1A6223B6BD386BAE180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664291, "uuid": "ce4b978d-8e81-4476-b7d5-cfd774fcd91c", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664291, "uuid": "a2de2475-ba53-4834-aa54-12667b5c2312", "value": "1536:UmjklNrqI1q3y2z79tGRh++TVSi6nYVa58po0e2/T20yZF+EFaD:1j2K/+b81KSdZYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664291, "uuid": "dc317d47-0b28-49fc-bf80-c777fe427822", "value": 176304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664291, "uuid": "55cbf587-0373-441f-8bff-343db3c1fd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664291, "uuid": "e34b6c69-4992-4fb5-a642-f1ec82727bc5", "value": "11609064f34537f722ed00513d9d89ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a302a7ab-e154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766641407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641407, "uuid": "1230a7b1-c0ed-43ab-a035-7cec40b3e1ec", "comment": "Malware payload", "value": "1338eb148e3c4bb233b22d2e8c7d230a", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641407, "uuid": "a6ab0a26-c6b0-4ed1-9af5-8b34993cc76d", "comment": "Malware payload", "value": "8057029459aa1072fb474eab304a07e2c238239fe095acbe8ec48aa5c86fa160", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641407, "uuid": "58661d7f-aec0-4f01-87ec-02817fb4bdc1", "comment": "Malware payload", "value": "58d5d40bca1e512b67cbbc5f88678675df2cf2cb", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641407, "uuid": "9fe9e2ad-4808-4a75-a5da-e8f07de25cb1", "comment": "Malware payload", "value": "dcb1e78c343c45703fd04b0cd59c325187932374135df7343b97f4930c3fb6732139f5193aab753d07dda2439565cb03", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641407, "uuid": "7a361710-32fd-4f4a-a9ac-4d3f173d4ee8", "value": "T16E6196652E36DBF81592217A1F7FD4480732465B3045FE897ECCC780EF442A9929D3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641407, "uuid": "07c52efb-de96-45be-8301-ab1f1bccff50", "value": "96:IVE7Cacg+Ps01pwhB/BD2goy4w69MK16W:IV6Ca61YpKgR43MKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641407, "uuid": "48464281-0432-4132-a458-8834bad13d5a", "value": 3328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641407, "uuid": "a0f7b454-58e8-43d4-b745-8218478dde8d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641407, "uuid": "f29f14c2-6aaf-44a7-890c-dd86ba8f274c", "value": "8057029459aa1072fb474eab304a07e2c238239fe095acbe8ec48aa5c86fa160.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ddd937-e1c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766691420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691420, "uuid": "7bd30223-67fd-4fc2-9af1-c59233283c33", "comment": "Malware payload (Vidar)", "value": "022c41be0bda02c3e0d557186e8a6c50", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691420, "uuid": "689d3d87-f25e-4812-a92b-5615188bd8a1", "comment": "Malware payload (Vidar)", "value": "807160cebe03f91eff7d454b9d4df36b81a929f0fa521d0500b472cb78b4263b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691420, "uuid": "66f5ee29-7ff5-4900-bb61-e01121c240b2", "comment": "Malware payload (Vidar)", "value": "363391fc602333c6fc1b305c4f8a4c762f985e45", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691420, "uuid": "e1af9739-5cab-4382-ad5f-862f71448a10", "comment": "Malware payload (Vidar)", "value": "08177285ece75f7a557dfa741c25a5680e0a82b886c110c750bc1501158f1e37e29ccc6fcb459b1939a145afaf9659f1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691420, "uuid": "80a850be-19ec-4720-80b1-088b308e4fea", "value": "T13D964BA3FE54476AD59FE33DE8A2028672307904077131D76A6036665D3BBC41A3BF2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691420, "uuid": "1c3101fc-9464-420b-b937-700bbfd7e66d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691420, "uuid": "2360139d-49a1-42b2-bb5c-61195161eba6", "value": "49152:OdtLWRQlvRB5a6mXOA6bXjMRGDMBHdyXWQBDW:OzjDMImHQWQBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691420, "uuid": "9eb4a5b2-51de-4c62-a140-ddce91f8fd32", "value": 9461376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691420, "uuid": "c56d09ca-51e0-4583-930c-8086333b05ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691420, "uuid": "2fd988dd-d925-4625-a103-e37b1cf9d56e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd015a3-e190-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766666923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666923, "uuid": "2e399610-b7a1-4563-8c33-3eebb31765e5", "comment": "Malware payload (PureLogsStealer)", "value": "00036fbe5dceab7b0ca486e3f589a496", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666923, "uuid": "17ad2df2-80a4-46be-bd19-ad428b945192", "comment": "Malware payload (PureLogsStealer)", "value": "810a793a997d62829d45fc8c28c6808b9303256c2e4a635af39e7e142b4e0c79", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666923, "uuid": "11d33053-44a5-4beb-9b1d-3e445fd3c10f", "comment": "Malware payload (PureLogsStealer)", "value": "01e2c19a0d2138e66c979979c1a67e4d46e4e245", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666923, "uuid": "7146ba46-69df-4a23-b208-30cc49cf8b72", "comment": "Malware payload (PureLogsStealer)", "value": "73f07dd108b1677fd8f81d223c0dc5ede954ce067e782e0859dfb71a3b2ea88604e30913d56b92e5812cef897e0c9996", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666923, "uuid": "cfc9a912-30ce-4e62-a8fc-282baafd007a", "value": "T135541246626C9707C6CAC6B6E097E0897B95FA6B1C83C3BE384D3375291778F4E12701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666923, "uuid": "c1e996cf-b8ea-4b32-bff8-45886870b245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666923, "uuid": "c2067af6-8e9e-42e7-8e29-45885fbc3b56", "value": "6144:eqmoVtQQci0UCVCWaPAGDuklvcu8FEKKITfshzbFq1N:LVGbi/YaP5qW84IzIz5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666923, "uuid": "0f1edf58-a405-4c78-bd8c-fe2d000012d9", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666923, "uuid": "5dbf9750-0cf8-4b14-8b93-f343e1dc9440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666923, "uuid": "9b654152-0f69-4ef4-b5a6-d237ba96fe77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7c6639-e1b0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766680834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680834, "uuid": "cc904460-af40-43ee-a5ba-d0403bb1a9dc", "comment": "Malware payload", "value": "4c058ac2a79bf5840e40433e5b78ba1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680834, "uuid": "f42bd14e-ce92-4376-b779-2cdad21629fc", "comment": "Malware payload", "value": "811d1d9cba14e96d732945b0ccefed770f8f330427708306a3b6f8b6dd284e6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680834, "uuid": "a5d9e935-d80b-48f2-a663-e4d6d1d04ce5", "comment": "Malware payload", "value": "f317b11b79cd75cd7d7332642316d8ddedf7538b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680834, "uuid": "4c88c62a-9c63-4a27-b244-3c3f0807c81b", "comment": "Malware payload", "value": "02c1188720b821917c687050b986d1bb64711bbd81cb3e80220b6823d7a1f9441ee12aeae3cbbf436e5fa81a41a7840c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680834, "uuid": "d3ef5e49-2a0b-418f-9982-b8512f5a025c", "value": "T1211712657983C0F5DDC608F0D33E6AF71BB18C56675648F369C83844E0B2AF6207E69A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680834, "uuid": "a3ad2713-7224-4e0c-a5a7-e95e689a1616", "value": "49015b6a8db8da486e252b254dcdfea4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680834, "uuid": "9ae0842b-6672-406d-a690-8b410667807f", "value": "393216:Jp+hTarGu6PapSY47Aj0u11viI7hsYB0:X+hTarGu6r7o0u11viI7hsYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766680834, "uuid": "b1c8519a-03e9-4cb6-8d87-9ddbd541ca9f", "value": 18625504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766680834, "uuid": "f44ca38d-2398-4d06-b5f8-b72b1f4d82b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680834, "uuid": "085d4929-049c-4e8e-9520-bb15c9421cd9", "value": "python27.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aed81ec-e1ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706543, "uuid": "a73066dc-83f1-476d-b00b-a4396e6d7485", "comment": "Malware payload (Mirai)", "value": "ab0ee4385e411d03cf00bf81a6950405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706543, "uuid": "1ccd8e3a-8f76-477f-83d2-327336434d7b", "comment": "Malware payload (Mirai)", "value": "8165d60ca91641bce27d394cf89204f84941188feb6a73b17278e08b40157385", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706543, "uuid": "6ab807e0-4e80-412d-9560-341bb76c4948", "comment": "Malware payload (Mirai)", "value": "1a99a55c0d1b7daaa1250f404ecaaf272d01a395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706543, "uuid": "da24d552-3ecf-4bcb-b277-ce4bcde70013", "comment": "Malware payload (Mirai)", "value": "0c757d5bc85770f1d6bfc3760d4451c087470b3075b627f917734ffc6998d389f9feb4ee5f59670681e58bcefd667d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706543, "uuid": "6b02d71e-87c7-4473-b782-15678544bc27", "value": "T11D237C36C46E6E54C848A274B4308F781B53B014D6C71FFB5A4689B54083EACFA5D7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706543, "uuid": "78d066f6-06c0-43cb-a6d7-2b0b68292ba2", "value": "768:matcSJp1MxwxxTKAgkm4T7BGIlqQW/jU0C2oFBSCrTT:matcSJXxpKbkmiBGnjLU0OXSCrTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706543, "uuid": "95c5df19-ef4e-492f-8ed3-b6d3e0656ef7", "value": 46260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706543, "uuid": "ce919124-3380-4cdc-9c21-872bb8f62ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706543, "uuid": "e7912a0c-75da-4684-9d20-d895993f8d5c", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2f9f6c-e158-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766643199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643199, "uuid": "1c0c9564-7242-45ba-a10c-5b9ed058ceb6", "comment": "Malware payload (Mirai)", "value": "afe4dca8b0fdf07bc3485ac0b98db8a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643199, "uuid": "34d1d899-4a2f-4466-8990-ca6f16236f5d", "comment": "Malware payload (Mirai)", "value": "81ec868657e20a8ae31df066f0dcec21d977b45171ece8d5a1584afc6275e9aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643199, "uuid": "55a41669-fd66-4f19-9a30-7fe62d2fa60d", "comment": "Malware payload (Mirai)", "value": "78f75ca5263eda3419411da9fb335bd7b69cdb8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643199, "uuid": "1d829082-fff0-4f2e-bcb6-8aef9af31342", "comment": "Malware payload (Mirai)", "value": "7884f0666660c65d0a3665ba078fa4884909fb4599b7a2ce7dccdafe74f2d1934e2dcb62bba1420aa6e78d4eabfb50b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643199, "uuid": "bf1882a2-2011-475f-b5bf-c19de735e9a5", "value": "T1E014EA46BD518F23C6C311FAFB9F429C772667A8D6EB3102DD157FA437864DA093A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643199, "uuid": "31dfd922-8213-475d-9dc4-5f16747f27f0", "value": "3072:pimS/z//o55nnTAHfWfib62OKTEADIN6kPLUrF6ZkgwJJgjj07nG6gPL:fMzXInk+6e27TdDIN6ILDkxzgjjTPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766643199, "uuid": "0edc6df7-0766-49ce-be92-4790ea0697cf", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766643199, "uuid": "36763ae0-3aa9-42ee-91ca-f8c645955b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643199, "uuid": "95bb6c10-48e2-49b9-b671-64979d9154b6", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8845f8-e1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766684859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766684859, "uuid": "88f29542-61f3-4571-9876-dd565a219df8", "comment": "Malware payload (Mirai)", "value": "731ba7f20b23646d77023f5bfda787e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766684859, "uuid": "10794b1d-dd15-4bd0-8d2e-8c4d800d9e7c", "comment": "Malware payload (Mirai)", "value": "822eddce1da4d9003e3ff3a28341905f5fae43acad86753d74e1c2fcae872a55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766684859, "uuid": "3d47244b-1a0e-4f2d-b276-e15a530e3d38", "comment": "Malware payload (Mirai)", "value": "648fd0303fff4a4dfba070b31e64df29e93cb4f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766684859, "uuid": "07e80690-1e6b-459e-91c8-15c0824d54a5", "comment": "Malware payload (Mirai)", "value": "7c8d69d897891ec18f859627dbe4753d5d05217c2c70940037adc0bd846cbed744dfd10ea0e3263b580a5dd031a73bb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766684859, "uuid": "37eb72d9-b061-4c92-b2e1-df15b1c6c696", "value": "T14983AE73C82AADA4D5584638BDA48F385B63E40486271FFB5696C76B4087EECF5093F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766684859, "uuid": "accfd0b8-fc55-409f-af7a-332e2d04e5e9", "value": "1536:3//iJW9a0iihCwt3rFYY4dFRkKFeZ7l4iyKy32GxN7CCtmW:3noqO74ridJWl4i1yZN7C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766684859, "uuid": "691a233b-4b71-4206-ad40-e6b9db98ac20", "value": 84536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766684859, "uuid": "00a6334e-47cc-4857-9ebf-1ddcfbc5b536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766684859, "uuid": "e162dfb5-f24c-4fa5-8c95-1111cc59815a", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd669ea9-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690870, "uuid": "02a26c62-dbaa-46c1-b96a-a4f9769fc861", "comment": "Malware payload (Mirai)", "value": "0076540bbb4fc148ff33584d8386a9c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690870, "uuid": "9d55205c-f85f-4a90-866f-bc057d6f21f7", "comment": "Malware payload (Mirai)", "value": "826c3a0cef5b276df3e3c86ae54dac258178b2a1985da14e9023d44f75fc6cbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690870, "uuid": "b4371898-c873-4fd7-8607-6eda88b3f665", "comment": "Malware payload (Mirai)", "value": "4131c2441e3dc68687c383a6120c8ba581f4cb68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690870, "uuid": "65507f35-8e06-46d2-be43-e68883dd4fd8", "comment": "Malware payload (Mirai)", "value": "845c0a0f89f21372112f3df5a053f00704e52a3b041f0280451ace9704fd07dc843beeea71780e4b0cab6d4395bd0aa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690870, "uuid": "85aacf19-cdba-4c43-89cd-dd039aa2efb3", "value": "T1ED2132E7B5C15C96DF34D93C8E314771BB56EE68C64FE38B4E00D199193728867880EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690870, "uuid": "d5208fe5-e07e-43e1-84b1-f4aa011c7ad1", "value": "24:7LkAdGtlH4rUpTXtWpG67G2ktmE6mJCGokC7m13hVNfeJ:7L7dIH4rUpTXtWpG6fE6mgGo7723hVNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690870, "uuid": "6bf64ead-7297-481f-b143-dfc1aa11f2a2", "value": 1200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690870, "uuid": "1d11ce3b-6225-42b4-b2d0-99ac4d605c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690870, "uuid": "46b009be-fee9-410f-af93-291b87a117a5", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6972ed-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626068, "uuid": "e9a7280f-3e79-4c26-b3d1-a9f55c599ec0", "comment": "Malware payload (Mirai)", "value": "81e22a4a071efa309b1c6d1e42b18f4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626068, "uuid": "11e68058-ced0-4499-8985-e1e1cc18d55f", "comment": "Malware payload (Mirai)", "value": "82ade37f77110904aa9e73f0d1e4811a38f4b1b80268ccf57d46a69bbee38003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626068, "uuid": "70588402-0a5c-47d2-9500-4c53011082cd", "comment": "Malware payload (Mirai)", "value": "8a44781cee557ac0742059c223c05b2fb0fbc123", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626068, "uuid": "66556b85-579e-4ce2-a7d9-be43dd6c0d86", "comment": "Malware payload (Mirai)", "value": "b64ec427e8c320a7cc46cd7197bc16917538c836437a426e652b9e1838eaaa08f879f48ef041332c36a403d0bd32844d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626068, "uuid": "b9ede258-91bd-452f-ba36-ab2bf7c28968", "value": "T188C2C021F25835E7C3700C36E5B18A8ABBC95EACD36A711366164B446BE3502E7B84E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626068, "uuid": "93446c1f-1f01-42d5-8e19-08f7ca2b8fad", "value": "768:qGjq311+vPgN6cvSK4a4VFaNKL09q3UEL1w:jql1welv6HVFkKpL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626068, "uuid": "c5e65536-f9d4-42cd-9dbb-8bd1590a3494", "value": 26676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626068, "uuid": "10d3f1cc-1342-465e-867f-143d9d37abbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626068, "uuid": "433b8c7a-d68e-436c-884e-bd9070418f3d", "value": "0.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8533441b-e160-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766646511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646511, "uuid": "167f7ab4-14a6-40db-9b13-d451187f3f1a", "comment": "Malware payload (Mirai)", "value": "0726e5a8c6ebc5d1ccce693cc6a5267f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646511, "uuid": "b80e2f4f-a43d-4b28-a22e-0fa7d4126bf1", "comment": "Malware payload (Mirai)", "value": "83b79f552a2d75bbac604a522debc2191cc9228dc74f79cb5b6279dbebd33d52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646511, "uuid": "fe05e5c8-f9bf-48a7-921a-fba1e9d96d3a", "comment": "Malware payload (Mirai)", "value": "955305266827e5d4e2f530df67f3cd64b1a1f536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646511, "uuid": "37615190-e3f8-42fb-8a77-fb83735e9875", "comment": "Malware payload (Mirai)", "value": "525eb076b8ae746c6727578e2ae21d65dc501763a049c62cb216ac285e17b7da023942aaab447017bd19a0dab633e3e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646511, "uuid": "eadde190-60f8-4152-be12-18f6aef04390", "value": "T10BC3D70AAF611FFBEC6FCC3746E9170525CC651A22A97B757934D828F24B24B06E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646511, "uuid": "ed234d10-7345-4f28-83a5-f0ff74291c20", "value": "1536:wFzhg3+CXig6VeYTlVQpjIMOLsMpYvRr0xKJTcy1dsIWWFgZxAWhK2S2yZer3:Uzhg3+CSKYTlLTCQrIxgXyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766646511, "uuid": "2fee7661-f941-4c53-864f-ecfbdf5383a1", "value": 125912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766646511, "uuid": "92da7ec4-7296-463a-a07b-83f5640eacfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646511, "uuid": "7c97da06-7854-4bc6-ba35-4a7815e6b0e6", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0426b1-e126-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766621617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766621617, "uuid": "a0f61e27-e179-4f5f-a64c-03ca09ff708b", "comment": "Malware payload", "value": "08553a3e76d34070a09c6631b59faf61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766621617, "uuid": "abdfb09c-ec83-475d-a0cb-5fb6382865ab", "comment": "Malware payload", "value": "84e230e4478ca72929533d74eefe9bfce93d013a82cdcdb59032280bb7d30045", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766621617, "uuid": "ff371191-332b-4882-8037-8604082ccb6d", "comment": "Malware payload", "value": "9c057eb4bae6162c3d4272b4b9818f5d0d5091b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766621617, "uuid": "e653972f-cb4d-4626-866b-96de4fa24df5", "comment": "Malware payload", "value": "e29c96d0bfbc7b136a583fa3ff9a80357067ae5280f24013d0ba83af4178258fc4e119e08043d0fed4fbcec80b018009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766621617, "uuid": "1e0d818e-403e-4c28-83d7-97711583a400", "value": "T17242B61BE1D3C9DCD16DD23C57AF8172F622F49E4124B67E678893822E9CE309714B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766621617, "uuid": "59449948-4693-44ca-bbe5-7caed94f99fd", "value": "96:GG0SAe7GxVcu66QNqdXcmnhRfmVDme8gp1VvlAv+x1DCA86ITg3gndq/vPKU4gSI:GYqsuX1TfmVH8gp/vlAvQt38a1fdBEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766621617, "uuid": "503f08e2-4b32-4b34-b8da-cda573f32f32", "value": 12767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766621617, "uuid": "cf7185b3-3bdf-4b2a-a182-0e041e84a60b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766621617, "uuid": "af019df1-8d44-4160-9417-8e722051ecfd", "value": "xmrigDaemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ec1293-e1c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766691391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691391, "uuid": "3a082324-ee9a-4667-94cd-d6c5b9a42a72", "comment": "Malware payload", "value": "f67d3952bfef365eb7edf4984ea29c2c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691391, "uuid": "8b8e0776-df82-401a-8d83-f01576ecaa08", "comment": "Malware payload", "value": "84e2b776c5bcbee2070b78eecea3aaebf5aef44d6fbb6466143fab02c4dcefb1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691391, "uuid": "dfdc627c-22b5-4f9b-baa6-db222acb2274", "comment": "Malware payload", "value": "330b84e10ca24da9cf967403708d1131b680d7f8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691391, "uuid": "1e38d7de-01c1-456d-bb0f-6f0c0a55984e", "comment": "Malware payload", "value": "294606857c444b49ad0007d4aff5a71cb24f860b43877fee48581eccc9382d8d2325a1368966b3105fda8c3d0244c4df", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691391, "uuid": "ed08b19c-c5c8-489f-8306-370eb6778e95", "value": "T122863BA3ED50076AC59BD33EE8E2028572347805173125D77A9427665E3BBC81B3FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691391, "uuid": "44c74280-4bee-4471-820d-c45d88a66621", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691391, "uuid": "072eca5d-7585-4dbe-bd12-aba76947dd58", "value": "49152:1WliBd/5gEG9xM9EfHB9RY+1BOoh/yAnpBcADKtMJGUVyjgKdydUf0ZAnpBcADKO:1Z7bdE3gSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691391, "uuid": "c35a62b5-d9ca-43e1-942f-c02a02e787a1", "value": 8495240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691391, "uuid": "60143841-83a1-4c62-818d-2f4a573cab11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691391, "uuid": "601f79c1-ee1c-4af0-867a-7d330ed91f62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a94632-e1c8-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766691310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691310, "uuid": "acbd2018-d214-4477-a10b-56d7b169fc63", "comment": "Malware payload (SalatStealer)", "value": "5f193493db88390d40e025acc6d56198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691310, "uuid": "e4f97109-7b99-4f04-9a22-9b760652d787", "comment": "Malware payload (SalatStealer)", "value": "86a0bf1b269d3527831cb271f210b3f745262bf7149636bbb5c85db03d0fc508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691310, "uuid": "eafab9bb-ed06-43aa-ac48-227b9de9dbc5", "comment": "Malware payload (SalatStealer)", "value": "7a95f2352af65f179dbf0b3514fbdf338f497482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691310, "uuid": "770b7eea-95e0-46ef-a9fd-d399255217be", "comment": "Malware payload (SalatStealer)", "value": "77f6cf601e737f7a55945b611f59a6f948ca3205c006c8abd45fd61f4ede5c7dd9d29682f89e7e171d40ea62cc43c7ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691310, "uuid": "0092a58b-815a-488e-9e8a-04ae50c6c090", "value": "T1C8C64B41FACB54F5EA031831816BA23F63315D049B28DBDBEB547B2BF877681187B609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691310, "uuid": "a1e11848-674a-413a-ad0b-df18444e66c3", "value": "49152:z5qC9LLI5HRbIdHNdVl6F17RDEzFbU0oDjXw5OWgC8nINyTA3Ugcz/jCWvo/XEab:tr9fIktNdg17hu8fsjP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691310, "uuid": "8d800f17-50d4-4673-b09a-04fbec2b09fb", "value": 12113408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691310, "uuid": "b3d6a389-129b-47a0-9583-9b60cae1ef70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691310, "uuid": "2e6ba93b-b8e1-46a6-ba0d-10e4f54372fd", "value": "86a0bf1b269d3527831cb271f210b3f745262bf7149636bbb5c85db03d0fc508.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6048e1-e1c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766688696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688696, "uuid": "2a3b07b6-2496-4b46-949a-3443ff163476", "comment": "Malware payload (Mirai)", "value": "45d4c332f4718098182792606f7afd9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688696, "uuid": "5d6cb1ec-6ef7-419b-b8fd-fe169b4aba55", "comment": "Malware payload (Mirai)", "value": "8730e029d0f40e909494760198bd41b3a6aa44843a8968910cff20dea0fc35ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688696, "uuid": "6d365dbb-dc7b-4dc7-bdf6-453d98d55dee", "comment": "Malware payload (Mirai)", "value": "d21e071e2e413a14639ac60bfda156a398a91568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688696, "uuid": "43e2c39f-45d9-4ca7-b4fc-713e5ebdbde1", "comment": "Malware payload (Mirai)", "value": "9d3ed67550ad8cb2e89e557d57be4f1627d17e902299cd725c860eecc3a0eaf3d3736559f1976cae0f1694f0d2d73fc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688696, "uuid": "3a50e7bd-54c0-4365-82cd-0bbda094194b", "value": "T1E4E33C56EA808A13C0D61776BBDF42463323DB6493DB73069914BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688696, "uuid": "8a37e2fe-e718-402d-9d40-97f93190a00e", "value": "3072:fZG7w+P6fYnfvYauiKF0PDJ+HY6BwbCulHKM/96Yr:fQ7w+P6kfAauiKF0P1+9oCulqM/96Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688696, "uuid": "4b8e79b3-55ec-4450-b939-c4a5e059bedc", "value": 143963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688696, "uuid": "27d3037b-2476-4e56-bd49-97aea5174b42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688696, "uuid": "f972668b-3aab-4c79-8bb4-a61a5195a488", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c7225f-e164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766648425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648425, "uuid": "fd0ef374-7c88-4098-9630-9ed1a21b8a7d", "comment": "Malware payload", "value": "dc5a54f97befbcab9be127add089cf51", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648425, "uuid": "ccd3fc78-51f0-4c90-b915-9519cd2438ae", "comment": "Malware payload", "value": "8871f4c73973cf3a5d1833bf2140deb16b200439400797eda61cf3835cd60110", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648425, "uuid": "8c091784-f05f-4897-898a-b03d0fd5fbaa", "comment": "Malware payload", "value": "c7ca388012b558f8f1a23517233ca071b1e6903c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766648425, "uuid": "d65f5af2-fc87-49b2-aea7-47d6985a672f", "comment": "Malware payload", "value": "4eb4b906504d576fb7fdaafac8373ab5c4066090e29ac3bf82bf2b15e4870203015bd6d6b2caa7290397f456628a4d02", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648425, "uuid": "339e03e8-b2d7-401e-a579-d6c4c85bd96c", "value": "T14311F5FE9FA2613541D40A792A664439D80DADF43944CEECB48B0ABB7F84A14FD19B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648425, "uuid": "7f0d053d-80e9-4e2f-97e9-2444dd44bf92", "value": "24:efIdXIGDNIiIptKKIIo43lIrfIwv7jIv4s7gIsR0WJI0Kn4747In0:efIdXIG9IptRI8lIrfIwv7jIv4HIE0Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766648425, "uuid": "3004ed45-7375-48d4-aa59-3da10193c3fa", "value": 1102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766648425, "uuid": "9e72718f-63b7-41a8-8a1c-6303188fd729", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766648425, "uuid": "9d149b69-9f09-44a4-95c4-920779292ca1", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb8d5c5-e1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706195, "uuid": "5c002c91-a77d-4722-9a17-c7df0ce97454", "comment": "Malware payload (Mirai)", "value": "eb669726b00945510679bd8b0e0947c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706195, "uuid": "0dec4ae8-b348-4b90-9fe4-b786f9215337", "comment": "Malware payload (Mirai)", "value": "889ee8cd9e95e317442223c95ce0b85d06e746a01b4de87510c379bdbbaac5ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706195, "uuid": "56ce1958-89c8-496f-ab7d-d75711589fb5", "comment": "Malware payload (Mirai)", "value": "20b95b72f1e317b595dac720ef276f7d543602dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706195, "uuid": "64fe9051-662d-4904-bb9e-7e3dd3677188", "comment": "Malware payload (Mirai)", "value": "c56d45b293ae3b24a94157a767cceacffef4a1ff2161aa530d861a72d8641e6901de769315000e0b79f776a8cabf515b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706195, "uuid": "ed78e1e0-d809-4631-8cd4-35e07330277e", "value": "T1E753F846BC918B21C5D412BEF92E118D33272778E3DFB212DD106F24778A96B0E7B912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706195, "uuid": "e8c92cb3-8dda-4bb5-bb9e-7bab156b1c3f", "value": "1536:Q9n+pMhdD178Mrm/BIOeQ5eVnHZV6CCRe3+bSMDiQ/HQV3rT:UKadIRJ/HQV3rT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706195, "uuid": "02113007-4e97-4810-8c13-3bd45db7e653", "value": 60944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706195, "uuid": "4fcb1734-850e-4355-8564-6943904be5a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706195, "uuid": "f4a17356-5f13-410c-877f-d93a7980084c", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34349a04-e1e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766703928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703928, "uuid": "fd9ac3cb-80fd-4102-bdab-a904e258a494", "comment": "Malware payload", "value": "de9b08c5d3e3255d90e13978724a9958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703928, "uuid": "11a2ad06-905a-4de4-bb4e-5e68d78de159", "comment": "Malware payload", "value": "8a02b6e3537dc38c5b335d2d383dbc18c026888c1e0fa44d08ad012382034e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703928, "uuid": "526b2311-4fe3-466f-8180-2da94a87489f", "comment": "Malware payload", "value": "11c4fe8a59d0347adba7656d6bd58ba08a3029ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703928, "uuid": "9594a4cf-8613-4ed3-af54-db4da21d2db2", "comment": "Malware payload", "value": "321558ef77294215f84fa67c7e02c9f9fe7cde38c3041f1672219e7ae152d1907101b2e3412fe67317b2037ad8767b2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703928, "uuid": "705e2a4e-305f-4123-9176-6d42e71f4774", "value": "T1C2931F9D725072EFC867C472DEA81CA8EB6174BB831F4253A06715ADAE4D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703928, "uuid": "bcac5e0f-2532-4e06-919f-d9d883a4e5dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703928, "uuid": "39ea693f-d18d-43ce-99c1-4acb261586c1", "value": "1536:H6KqyaaKlQMrTp8jFQwx5irHYLz8JCPP27uC2KMtOJUYS3wVcl:axya5prTpiFQw+MLz8yP27uC2KMtOJUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766703928, "uuid": "a5a7019c-6dc9-47d8-a181-201334a8f725", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766703928, "uuid": "968f6e6a-25ce-4dfb-9748-dea71b5e1711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703928, "uuid": "4b3158a2-0e91-4548-93c2-0b307c83bebe", "value": "Hello.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f481939f-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626082, "uuid": "d010afa8-1911-440b-94ca-58a6d6dff920", "comment": "Malware payload (Mirai)", "value": "da73015d78545e046c752781cdaa637f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626082, "uuid": "e1534026-8b8a-498f-9ec8-92957532dde4", "comment": "Malware payload (Mirai)", "value": "8a692ea27709b97defa8408394882f2f59756472ce62e0e9309da85c3ae81976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626082, "uuid": "ccb3f3a3-9187-4281-9dd3-28eae8afa2b9", "comment": "Malware payload (Mirai)", "value": "bb6ea3e0f56b85ad10e0385e12f600ed22ec845d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626082, "uuid": "5f7dc52b-eb64-41d3-89f1-f3b82147340d", "comment": "Malware payload (Mirai)", "value": "df14f3a107efa2f91d96f24b42dec2e7ef8cbf38db732a41a0e60c840da9d8ab9a0b1ea59e288d036033f9fa7f4ba460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626082, "uuid": "2bf2e2bc-14c9-4210-924d-31ab205abd19", "value": "T1D463AF36CC6A7D90C1544774B8F1CA7A1B23B41196872EF76995C6B28003DACFA4D3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626082, "uuid": "651c5f75-d5d8-441f-b7c7-effabcc2aa0e", "value": "1536:haYSJDgHtKPyNHy7O9Oa6Z9lUyC5IjnhCmK6GITw:h+gN387OEiyYIjnhX35T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626082, "uuid": "eb6c7491-d634-4bb0-b5e6-c4f64aa21b1d", "value": 72088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626082, "uuid": "f805cb70-28b4-45d1-aa52-388924b1e8cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626082, "uuid": "61c5596a-92a9-42f9-9cca-c27e0159bfc6", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39d1005-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (DeerStealer)", "timestamp": 1766665487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665487, "uuid": "fc5e584a-7458-480c-9ebd-4f6023e6a7d0", "comment": "Malware payload (DeerStealer)", "value": "1a92e165fed7d1c4e90b2f12cf3c1989", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665487, "uuid": "55f9bbdd-8a22-464c-8703-2a04fe547153", "comment": "Malware payload (DeerStealer)", "value": "8b4a40d5bf036b2193ffe08ec01f8d5e5eebbd63ba793bea714965ba216362ff", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665487, "uuid": "54b8a407-8b9c-4717-87ee-1bcb8f25f6a1", "comment": "Malware payload (DeerStealer)", "value": "0d927189de68f7c2398775063dd91e46a529ae4c", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665487, "uuid": "5da4dfbd-fbf3-49ef-955e-fdfdf4d2ee6f", "comment": "Malware payload (DeerStealer)", "value": "ec32260ce1ffd2b87258d4c7d2c5210505c419fcb8375eb0f3898294db4089ab1116777ef6c9b1223d8a47e412cbc371", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665487, "uuid": "fc277036-36ca-4b59-8135-42b12b4ca359", "value": "T1AF063380F5CD63AFF236C6328AFCB19A1A797E54C3A49522708F7758473534C99BA431", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665487, "uuid": "e00e0ec6-e206-405a-a4d9-2b5b8eaf6ed9", "value": "98304:QLTAD0P74JDF2m++OfwrSTPf73hA41ADRkG3BOb25lD7YH:QLU00JDom+lwSz3hNAlkId5p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665487, "uuid": "8eaef4e7-ddbc-44a0-8c41-a4ac3c40986f", "value": 4005888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665487, "uuid": "5cc3169e-9dfc-4b0e-bea5-05db0fcb3c0e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665487, "uuid": "80f22232-f1d8-44fe-b612-7e2d36c711f1", "value": "UVSODSAE.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eef52e-e154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766641496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641496, "uuid": "6abfbf52-a41c-4e8f-a9a7-7bb44afd1939", "comment": "Malware payload", "value": "33037dbcc99223f80c8bd660f5f065ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641496, "uuid": "ec9ee45d-fb16-4eb6-95fa-86c70b91729d", "comment": "Malware payload", "value": "8b57daeabd2b0084718b22434beeef65150f6602ce87cff07a840e646541dd18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641496, "uuid": "8cd02a17-0834-4ea9-b96e-37b3f1d5ac3c", "comment": "Malware payload", "value": "80231e5f74cd482f94ab6fd5dee203e38291c04b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641496, "uuid": "efb6dff3-dc4f-4217-8d2d-0f550c8a6bce", "comment": "Malware payload", "value": "4f4ee7a123d20cc2a158bf0ff10a75798b133d249ed725942cd03d4ebbb36f68e672d8db24e857df0f027bf0787487c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641496, "uuid": "eb01f3d0-8427-4197-8e2d-b3ca6a72aaac", "value": "T10294E09AF7162E46C8D7893858C5C286974DE55B33F393863A03597B382E7378F28385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641496, "uuid": "cf7c67a1-5274-4647-834d-9737f67fa865", "value": "12288:AYYBpGHjVqbE6BHIiTKV9VXBU48pRM8/8:AnGKSiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641496, "uuid": "9a5221b6-4eaa-4024-90ca-8f6e8eb88a02", "value": 416252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641496, "uuid": "bf430022-4b2a-407d-9dd6-9b2a25aa5fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641496, "uuid": "3e285336-7ee7-44df-b550-664674e6a5af", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f119aeee-e166-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766649269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649269, "uuid": "415ebc4c-f769-4928-b7da-bce9d83ba8f5", "comment": "Malware payload (Mirai)", "value": "75632ec8dda0a4590f2cbb5ae6d725a2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649269, "uuid": "a8c5997d-0ffe-4be2-ae49-4e9d1c0125c8", "comment": "Malware payload (Mirai)", "value": "8c88bab565e4897fa8d74594e05db8c1f856d70a5d42e5619d10415c6c6c071e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649269, "uuid": "ba8c01fe-4264-4817-8851-a6b8ba959b35", "comment": "Malware payload (Mirai)", "value": "795c0259371e9c46be4c7fd93a6f9e12925ac780", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649269, "uuid": "beeee6fd-6d8d-4b43-8bb3-9500e3fc6fa6", "comment": "Malware payload (Mirai)", "value": "3cfe13f928ce782e9585d6ed5056e87ffcf0794be06caf7205def023c84b3a1833d7a6eac5cab9432b8cc8708cb6e826", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649269, "uuid": "f59cf80f-f895-4a1c-bb73-de5ff2e034bf", "value": "T194413CC7226147F26CA0DCB3326AD4C0B5E89195E4D66F4B69DC3CE448BFEEC64446C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649269, "uuid": "3e8eb658-8a59-4911-9764-ded4802b1b82", "value": "48:vod8jHttQdMGYdRb7QT6aCOIlL1f5NOI9xET:vod8jHttQdMGYdRb7QT6aCOIlBf5NOIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649269, "uuid": "b7b4c7ea-3bf4-402a-b97c-7fce4157663b", "value": 2124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649269, "uuid": "2a4d1432-aee9-4b26-b4aa-1fea435ac596", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649269, "uuid": "c8561815-ce61-45b4-ae13-62e995b54734", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5404b5-e18a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766664644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664644, "uuid": "cb922dd2-2007-45a4-bfd2-b5927e4a4ada", "comment": "Malware payload (Mirai)", "value": "82a17e84408a119f69e281f72ace55a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664644, "uuid": "17befad6-bd88-4b9c-96a0-4a6a44c86707", "comment": "Malware payload (Mirai)", "value": "8c9a736a4a78c6c8935865f687c8a777a24bd3cd3d697daa05a81f37e719d408", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664644, "uuid": "bd3118d9-797d-40e8-a2b1-364d4522699d", "comment": "Malware payload (Mirai)", "value": "763405cf18fce4bb877d85b6d21ad3c2937cb112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664644, "uuid": "42503316-41a1-4049-9291-42130f15ec52", "comment": "Malware payload (Mirai)", "value": "b3e8f26bec4d6696bb4e6f8241220b17287397b8ad01233f93903946315e54fb81eb168c83a5576ca5d296b4031512d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664644, "uuid": "cc2c7f94-5800-4463-b074-db556bd342e2", "value": "T16BB3B71E6E218F7CFBAC873447B78F21925937D626E1CA85E19CD6001E7034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664644, "uuid": "333b0b2e-0d86-4d84-9aa6-84d1221720bd", "value": "1536:HVX8yS1y1yxX9Lt1xXg1fqHFck9IhADCyHkI4NtPUiL83UeeHggRK:1MyENt1Ng1fqHiUDC1I4NtPrQEN3RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664644, "uuid": "de778648-fcbb-4765-a597-ecf18644c6ad", "value": 113572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664644, "uuid": "ad7bae8f-52f5-4bef-957a-3a0ab8d75658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664644, "uuid": "fa5896d9-e550-4dfd-88a3-8e1ff61f048c", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9240e223-e1bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766686476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686476, "uuid": "71499cb9-8281-4571-8280-d98f7b902136", "comment": "Malware payload (Mirai)", "value": "60dc940307fd0b60b4715fd259e211d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686476, "uuid": "64cb6448-326f-443d-864d-c452f41091da", "comment": "Malware payload (Mirai)", "value": "8cd2d031812ea1132264778864743ca4f623e3fda8144801aa86b4901450ffaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686476, "uuid": "23ba7d1e-2485-4eed-b084-41fc86d5cde2", "comment": "Malware payload (Mirai)", "value": "ee1b46086d429ecba91f584fe896c089bcd2e21a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686476, "uuid": "bee2b6a6-04bc-4e5b-b402-2c8894b74329", "comment": "Malware payload (Mirai)", "value": "21f1c689428f0c4eed8538bee89b813fee07db7c2765082b6f4e05601a936f703cf93245943b6ef488bbff6e98051c99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686476, "uuid": "a8db3edc-0dee-41ba-9e65-290d8bb35ab3", "value": "T1E7835B22B9391F2BC1D0A8BB21F38365F2F5478E25A8CA5E7D710E4EFF2464025476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686476, "uuid": "386217ad-bc24-44e7-8775-e3d6d1420ada", "value": "1536:C0Qy4A5IkwSe7quU2lodE0lCE26ktlsYl5vq3ftiWSe:FHkWZhlDgfsYXi38WSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766686476, "uuid": "cd1a8af7-367e-4fe7-a2f5-0c21efbdb0d4", "value": 87264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766686476, "uuid": "45d7b7c3-ce65-436e-956c-83613d217bcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686476, "uuid": "3bc5c5a2-7b8c-4324-a1d6-27b9a13d4360", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152e24ea-e1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706023, "uuid": "4358f7d6-573d-444a-98c9-e9533bc73efa", "comment": "Malware payload (Mirai)", "value": "8d592473dccd943d99ca234441a08d75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706023, "uuid": "9e943961-f501-42ba-b037-7d99d34f10d6", "comment": "Malware payload (Mirai)", "value": "8cf8b1df1965cd9dce2b82863f8f2fc081306a6b325095dc6bd0c4a9e01bf150", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706023, "uuid": "2aebbf18-4771-468b-b7f5-7ab31be6571a", "comment": "Malware payload (Mirai)", "value": "8863129e9fc8b455b5510b2db35dd4852f88d84d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706023, "uuid": "b516f528-bc6a-4f0d-97c1-52ba4346c676", "comment": "Malware payload (Mirai)", "value": "4538dd26f1cfe346db8587866a71eac673a7ca928b50875e15497cabb8f0db706c11098fdf15aa5162a590a106b3f739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706023, "uuid": "25ec5ac6-bf03-4bd3-a4ab-8240cc14205c", "value": "T187834C86A400DD7CFC4FE6B784270F11FA24B7515F620F27B666FDA3A9710898A19DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706023, "uuid": "fac65df4-6782-4ca8-ac94-b85b8daec968", "value": "1536:QTBOzEElbEOdO9rr2Zw9fiUTcVjo8QfOCfhkXAnSFyKRkjZjETPO:QTBODbEBZyQTcx+OxXASFyKRshf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706023, "uuid": "11018e75-2bbc-409d-8ac6-e315a69bc4e8", "value": 83696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706023, "uuid": "7794b49d-e967-41f8-85c1-9cfaeaa32060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706023, "uuid": "5b9a032a-8f8c-42b8-803e-c5cdd39c0f63", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c781c0-e156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766642298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642298, "uuid": "7675dc57-276e-4790-be7e-f040a9ab18b2", "comment": "Malware payload (Mirai)", "value": "1b749de97b1b1ad7c8b147400af867b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642298, "uuid": "110fbac3-e7cd-4b74-a0d7-0573af648279", "comment": "Malware payload (Mirai)", "value": "8d683fb59a9ff9a0a94e4e1205e1c6913526e4daa8fd9e8525687837ba574e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642298, "uuid": "76fdae33-7ba5-416a-b6c9-67f64211328b", "comment": "Malware payload (Mirai)", "value": "f692cd871b101dffdb82a6413421ea73abe4c995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642298, "uuid": "ac7e728a-6b73-4719-a9d4-ebf3ce11ea64", "comment": "Malware payload (Mirai)", "value": "e243cf97c042cf0174554f6cca24de3a4da878caedfa8134852c4ade3e9d7299cf9feefcff976a5bb372a43ca4b07bd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642298, "uuid": "83ffe36b-ef70-4e7d-80d5-f0434bbd6055", "value": "T1FE831946B9818B25C6D422BEFA2E118D331357BCE3EF7212DD146B25778B42B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642298, "uuid": "fe26f556-124e-4cb9-b37d-499c9c8d2d8b", "value": "1536:bxn9dWM+a9P/csM/mbD4xJqZk01AYDtaSSUSjvK4BrbGpMdiCUiwz7JEy17c0Yf6:eyl8at4USjvK4Uiwz7JEy1A08T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766642298, "uuid": "08ce4dc1-2f48-4118-afa1-448feee578db", "value": 83128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766642298, "uuid": "4d023a31-24a8-4679-bf16-1d89c6bc5c11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642298, "uuid": "b45a30d3-8a89-432d-8ba9-103a5e8d1c85", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee6b1d3-e161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766647064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647064, "uuid": "7eea8649-3b23-4c2a-b679-62e42a0933de", "comment": "Malware payload (Mirai)", "value": "eb6fe951b5d8e974011935304ee65ae3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647064, "uuid": "eeac99b3-0849-4343-ad18-6ae6df5c21a3", "comment": "Malware payload (Mirai)", "value": "8dd943710573673621919377e1f763af6988edb02c3274e1b0fc1053e659d11b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647064, "uuid": "452433a4-558c-4587-b55a-e79240e8f74c", "comment": "Malware payload (Mirai)", "value": "8f80b6f76770274e62e681d18b8b39b8c00b24d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647064, "uuid": "558acdd6-aacf-4c22-8689-9a32e4aa009b", "comment": "Malware payload (Mirai)", "value": "b1a19b705d2f352a80ecd06a5bb72468f2c9b62ecfdda196198a753a84cd823e3a05a6460e141b4575c1c97b29c49095", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647064, "uuid": "9b264d8d-474f-457b-9d3d-9e2b528039a9", "value": "T134631951BC928B6AC6D063BAFAAE658D332163E9C2DF3217CC105B157B8951F0D73B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647064, "uuid": "07d4c8e3-c61c-47b0-93e1-e6cf8957b022", "value": "1536:rmKkU9NHdTxAxT7pRkazOLfmzQCQqRecFbSar6tM:r/J9N9TxAxXkacclx+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647064, "uuid": "d7af9c9a-ed0c-4206-bf75-56826337f644", "value": 68224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647064, "uuid": "4b6ad098-e6d6-4b08-92c2-420d1a3fc0ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647064, "uuid": "3e945feb-7f05-4643-b77f-6fdf5e908fb5", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe5f29f-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700887, "uuid": "a6574cde-9cea-4e56-8629-5f4737c044eb", "comment": "Malware payload (Mirai)", "value": "7de5ee4da1891c60b5561d2919947403", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700887, "uuid": "543a724a-2dca-46b9-b68f-2172272cfd2f", "comment": "Malware payload (Mirai)", "value": "8e266ef62d376e3f980d2f32071f7ca8861f981f324eb3e18723d5cc4f5b0cd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700887, "uuid": "00c797a5-743b-4763-9f0c-d9299aeb6529", "comment": "Malware payload (Mirai)", "value": "69d67659bc124dbd224349db0c95cf778216e4bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700887, "uuid": "a92c6ade-48f9-41b0-aa29-4f8e7bfc48f6", "comment": "Malware payload (Mirai)", "value": "37caf0839667efca01a811ae48cee32afec9ad2b0e85633e99f96324ac29690708ce7bbc6100a34f0ff9357c7c731b16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700887, "uuid": "e3355b5f-ae9f-4bb1-8c2d-c2cd9e2ea761", "value": "T16ED34B2274391E27C4D0A9BE21B34762B1F26BD922A8C90E7D720E4FFF316506547BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700887, "uuid": "1c03a4e5-5189-4182-8aea-745abc6c6010", "value": "1536:5XYKYnCCogCfy7HoS/PRi3cANmc/TI0PMKPjyWprMTxpkBs5mmt7vVlM5N/XvgJu:xrYKy7NxGmwJPjyaEkBszJtl8NnZqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700887, "uuid": "f0ebfbaa-12d7-44f1-9e13-a7837393c96f", "value": 132568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700887, "uuid": "71cb24bf-bc26-4006-870a-aef382ccd38d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700887, "uuid": "664e49b6-1e9d-4982-bae0-2ac5ab812155", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4205cc1-e136-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766628605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628605, "uuid": "33b60ab3-7155-47e5-9378-22777d8c8727", "comment": "Malware payload (AsyncRAT)", "value": "6dd35fe24f4cf4f207b866885110f442", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628605, "uuid": "d64d9e40-488c-4028-9586-c6118db458a2", "comment": "Malware payload (AsyncRAT)", "value": "8f61cc3ad55de0b6cd15dd356764849fc3b2d82943dfd23ae17e541c09933f20", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628605, "uuid": "831cf416-ded7-4f1e-b640-f7240fb1c078", "comment": "Malware payload (AsyncRAT)", "value": "6c2fa754b1adc1c72ceb12c603582ae48e7d4ef3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628605, "uuid": "b66bd891-6d38-485b-acb1-307c851b343f", "comment": "Malware payload (AsyncRAT)", "value": "1ac49a9996661c9f65242f67ccb984efbd18eac69f5460cb584f9dc617ea7521fb8bee6d8eb31af6ba06281c46dd2d43", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628605, "uuid": "5a2d459b-fa3e-475a-b794-80c09ea715e6", "value": "T16A25D070F544DBA5CA7FB137D3F740A06BB2B1378065D2292AC9B3DC18637A32922657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628605, "uuid": "90673fc5-d095-41ee-8def-24c978bef268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628605, "uuid": "4e41331b-457f-4580-97d9-ca1154def4e2", "value": "12288:M4cx2iNcHcvn0+xAEkHcvn0+xAEkHcvn0+xAEVHcvn0+xAEkHcvn0+xAEpKfCXy7:Fw13TPTPT8TPTHxXuidqjzefpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766628605, "uuid": "69a8c3ac-cc0d-4b3a-af83-88727038e6f6", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766628605, "uuid": "6b035968-88ac-470b-a543-77dcab3a9731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628605, "uuid": "57e7724d-57dd-4d85-b88d-fbf30482e0a4", "value": "8f61cc3ad55de0b6cd15dd356764849fc3b2d82943dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d694c3dc-e12b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766623884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623884, "uuid": "d2720d52-9f40-43d7-9350-dba73731e0f6", "comment": "Malware payload (Mirai)", "value": "7dc5acec54e685b425f0ad501d3be198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623884, "uuid": "2add83ae-d730-4983-900f-9e9da47881ad", "comment": "Malware payload (Mirai)", "value": "8f6a29ee517a7bb5d9c3db16b8363420c732d8a9d7993da16006a05a6b80c836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623884, "uuid": "2630593f-0abb-4f25-8641-d0b26f956bd6", "comment": "Malware payload (Mirai)", "value": "ba3f966cc9a472486002d9b915022f26e8e29921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623884, "uuid": "c6c78a8b-817c-4265-8024-6c58b7021246", "comment": "Malware payload (Mirai)", "value": "cfeb12e5a611a04bc66853ff460719cf912f4456061468e765e85cb1019b5c277ac4856dfe2bbb0f9bedfab24991cc33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623884, "uuid": "ac091993-a5ea-42be-aa88-b41a35fa645e", "value": "T1E7832A85BC919A12C6D523BBFB2F428C332613A8D2EF7207D9255F15778A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623884, "uuid": "8caaa358-8ce4-4093-982a-c0890710aedd", "value": "1536:fdKKCoAdnjCfsKrz19HYZqn+KMiAjBZUbAeybtxvSTw1:fdtHlGqn+KMiAjcbZuRSTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766623884, "uuid": "7497df7f-fff6-4fad-b515-fa272b6975fc", "value": 83136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766623884, "uuid": "e6c11d0d-a079-452f-b2a7-dde476666622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623884, "uuid": "fcb4cee0-1707-401d-978b-8d285f244d8e", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66c7815-e156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766642299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642299, "uuid": "526f0e09-9965-4138-b8e3-1cf7a920c2ad", "comment": "Malware payload (Mirai)", "value": "ca5091dc28aac30e8d58300d8305768b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642299, "uuid": "375a1574-1d1b-4e32-8ba9-4c2573b39193", "comment": "Malware payload (Mirai)", "value": "8f77a86804b24afe7320724ac4cd04bee8d64cd8ea949c97acb8622cc3d58b62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642299, "uuid": "1f6994e9-e095-4470-8388-2eea6d2110e8", "comment": "Malware payload (Mirai)", "value": "101486c552749b5bf75cb8f0da735c6d29d3ace8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642299, "uuid": "0bc28150-1aea-426d-8785-83b88d931806", "comment": "Malware payload (Mirai)", "value": "48c68c49a1846c4979a7414248a9fa48c7b349f3a296f561ddee95e0cdaa896edec326a4eb9235d053cc0c7011c12c7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642299, "uuid": "74337984-b564-4729-8cf4-d545a30a04d0", "value": "T12B335A43321C0A17D4A61AB4293F17E0D3FFBEA121E4B289650F5B5A45B5E371086FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642299, "uuid": "472ddf1b-ba3c-4253-a7d2-dcd1e4bbae9c", "value": "768:r0D6cq3sQrXSnRype3JIHy0pvOJ3pdVWTuLWoSvhTSrdT9:l3sKknqy0la3p7WhoSvV6T9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766642299, "uuid": "7b0fc057-b594-43d7-a2ba-3fc23d7a91d8", "value": 50460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766642299, "uuid": "82a984fb-6aaa-42c2-a678-5bd415c2a969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642299, "uuid": "bbf964f0-604e-4219-912e-386727756439", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fab0afa-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672970, "uuid": "70c5dd1a-4452-4509-866d-339c6adb6f14", "comment": "Malware payload", "value": "086248809a5a3aa96222e65f54b9f77b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672970, "uuid": "73f46dd0-dbc5-401b-801f-95ee1ad0db0d", "comment": "Malware payload", "value": "90c548dc4a4ae49221745186f7782f13d3abf5e422c60d4c3a09d230104913ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672970, "uuid": "59dd01b5-5081-46cb-ab3b-aeaf4a80b989", "comment": "Malware payload", "value": "36c760e04091ba0da14f8b8fff4f431709a7d2eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672970, "uuid": "be3c4548-84e7-40a2-aad8-e5329e1abcae", "comment": "Malware payload", "value": "65ecec52a2402d9fcd2205972d1a508dfe8af3322ddfa01934adc9bfe6233e8d864aa93e91010c702fd8f41c4ffd0adc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672970, "uuid": "7c1363ce-9691-45f0-8942-ef5929c31343", "value": "T1F613B8CC3FC7B06493512063192FA09AFA1E4C44768C44A1E76759E4F96C728FB7AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672970, "uuid": "b92322dd-ed57-4286-8b96-a9811867ce18", "value": "768:4iuG+ux2GP550h74gBLG+na3vVX6rx987KsxzU4W59PcsEwnQ7fxRBL:4iu1Zo0h74gPAR6rx9xsBJW8AQNRBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672970, "uuid": "594a89df-30d7-4945-bd07-36892e1c25e4", "value": 43006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672970, "uuid": "9c30d98e-0a5c-4fb0-8a47-f0b8effa8566", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672970, "uuid": "372a5825-7241-47b5-bdee-84ec2b6f31a7", "value": "New order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60160acb-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766690687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690687, "uuid": "fcb33556-51e7-49ff-8110-1afa7b399544", "comment": "Malware payload", "value": "1717b6a95ce62666f9b0b8d07d246a88", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690687, "uuid": "43ec9ad9-ecfb-4008-987a-738b77ecbf29", "comment": "Malware payload", "value": "915624a17d19707259c42f60fca2004366ec7b7e123e9e6c4da7e0783eb4748c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690687, "uuid": "8fd0b183-2747-44ec-bac3-7faecae9c9f6", "comment": "Malware payload", "value": "a4cd46980da0c177f1dca4a14852c784321b3978", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690687, "uuid": "ae97eab6-180d-4b17-b4fd-a03e275a491f", "comment": "Malware payload", "value": "8cf737f9e3d1f9a1ff39120d4d718cbf332bdd462c14bab63163add297d87f49e0240d4b4b5a58c7a9c042b9262f35c2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690687, "uuid": "ecb0c4c9-bc3c-4204-8460-9ce76d570c3d", "value": "T1C4E1E896ACF32419640B906DCFBFA2583059901B474ACD9CFDCC75A8DF4C2A88622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690687, "uuid": "40c3da16-06cd-49ce-a06c-25d5801fa11f", "value": "192:OZ6vIE/CTK/es8QKe0llHYoHsfOBro2Tc/O1nSmy:O8F/F8QKvYoHsfO2/yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690687, "uuid": "a30c05e3-c119-495c-a99d-09c830eefa39", "value": 7373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690687, "uuid": "cfb82d63-8dd0-4700-b13e-221f78707b77", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690687, "uuid": "5cdee2c1-80cc-4faa-bcac-2563add2666c", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbfc443-e1ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766707135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707135, "uuid": "5039f4a3-3e25-473e-8bf0-bd033f4dcd61", "comment": "Malware payload", "value": "7f3f88c00ae1592e3a664c907628cc7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707135, "uuid": "a1430e1c-cc64-46e7-ad82-563297c0eaf9", "comment": "Malware payload", "value": "91fad06f2a695577e1a459bebce6e9affbcb64f47076592c7018aec921a6b0b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707135, "uuid": "53bed791-1678-4d44-bca1-287fa4c3501b", "comment": "Malware payload", "value": "53323f2c1713d18f8b52cc1239aa3e1d989bec06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766707135, "uuid": "e5fea0bc-149e-4350-8f9a-2a791530c2b8", "comment": "Malware payload", "value": "ce7a860b363e6de9297a0a71a1ef8a4e4792a0b76d74a82471e1d58905fc4eb45b74a1b80022aa272701c8119d026f1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707135, "uuid": "a703431e-ffdc-429e-8b73-9dede50884ed", "value": "T144732A85B8818623C6D422BBFA6F42CD331653F8D2EF32079D25AF15778692B0D3B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707135, "uuid": "cbdab034-7f7a-4113-a029-568d5d2a03c6", "value": "1536:bixhS+e0Mkk/7vnj/cdWrDg3e+xKMePJCd/e2obqlvmTAbVR:bixYdkqp+xKMeBCd/Pf9mTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766707135, "uuid": "5a4d6852-dd5b-4e8c-b9bd-42b06a18ca7c", "value": 77800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766707135, "uuid": "727e22e0-533c-41af-842a-d3e417a23eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766707135, "uuid": "dd66a8c7-dcf6-4a5a-9320-3fd09081d466", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb05a185-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Merlin)", "timestamp": 1766666385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666385, "uuid": "14f9765b-5c5a-46ea-9d71-623492882a71", "comment": "Malware payload (Merlin)", "value": "9377f142be84e4846576d181593742a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666385, "uuid": "2c8c97bb-b773-4b72-ac5b-8d8345563a5b", "comment": "Malware payload (Merlin)", "value": "91ff90a50a73885b19a4f9b1e9b743eb5dcf8635c770a77960f51c8387f1886e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666385, "uuid": "2716774d-150c-4f96-b2c8-3a9136812fef", "comment": "Malware payload (Merlin)", "value": "7def8e35d0218d47ae8975794b0848def461e5ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666385, "uuid": "d7ce4048-93a7-4f91-9d24-46a1842876f3", "comment": "Malware payload (Merlin)", "value": "4febc32c3602443638cbceee0d1d6fcac6b75feb6f787abe70ff03604271375087507797c4c00bcf7e84eb55e77aa3d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666385, "uuid": "0876eb91-e708-4fce-8d62-86433dbbccec", "value": "T150E63851F9C754F5EA03153140ABB22F73355C048B3ACBCBEB507A2AF873ADA5936249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666385, "uuid": "a0e73526-0901-4fe3-9f55-364752f2a16e", "value": "f019a94a0f226134d00392378e5bc990", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666385, "uuid": "8c415cd3-6c99-425d-b258-b3072d903380", "value": "98304:KzC/HqiBlOBTYZQbuFqb+BbkFSJJIoNfMrEsNtW+vInWsUsh:rKiBkBTwFqb+BoFkJLfM4sN0ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666385, "uuid": "572f4671-5008-446b-85a4-044bc7a5bdb9", "value": 14179986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666385, "uuid": "78bb5514-8c89-4d03-8aa2-2846f35045e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666385, "uuid": "549009f9-f0e1-48ed-9b09-878321bf93c2", "value": "SecuriteInfo.com.Win64.MerlinAgent-A.86927783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8fd41b-e192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766668022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668022, "uuid": "937a1f20-d02c-45de-a624-d813f0058f76", "comment": "Malware payload (Mirai)", "value": "fabf9e9c3096558a365238662f02c058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668022, "uuid": "d6e96c23-cd65-4262-924d-884cb4948bfe", "comment": "Malware payload (Mirai)", "value": "924923d36895972eae94d9d41c38959806c0373995befe0728c6735cb845cf48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668022, "uuid": "281960d0-550e-4a04-b7c8-ec3c80e5a3ee", "comment": "Malware payload (Mirai)", "value": "c1e041107340646446921223d4fe2dd37e3d41d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668022, "uuid": "693c50ec-bae7-4e6a-a25e-08af4037d202", "comment": "Malware payload (Mirai)", "value": "b0ed2435460729e61e08bdffd16ffd6fc8c86ca5739cc79964689f3ba08dc582ac4b3e5303285cb20ec5aaa8974536f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668022, "uuid": "71a4e723-5f5d-4987-81a5-b2817793899d", "value": "T1DCA31956BC818A12C9D413BAFE1E118E331357BCE2DE7222DD105F24778A96F0E77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668022, "uuid": "dc8901f8-a1a7-4043-acbb-7396957de2b2", "value": "3072:7k5xoeyABrUaczKcAEfkEO+EdDHaLQAiDbmf:7kjzyqgaczKWfkL+Qrahkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766668022, "uuid": "96fa7506-aaf6-4659-809b-2fa51bd8c7b5", "value": 103732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766668022, "uuid": "2eec7e1a-2b8b-433f-93fa-ecc5a6733bb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668022, "uuid": "c00f43e2-ce2b-42f3-ae36-b296d1f5a986", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b655b96-e1ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766679512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679512, "uuid": "38ef8183-bf50-474e-bfea-d7ca8d0549ee", "comment": "Malware payload", "value": "cf64183e1bf2fa82bc93fd3fe1b8bb37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679512, "uuid": "2dc0ecc2-25de-4916-9f8c-b3ff8501c8b7", "comment": "Malware payload", "value": "930e7cd04c1dca3c7505ab182d2924a63bb7abe4da8f06102cfac9460d74719a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679512, "uuid": "464156aa-9675-409e-ae40-84fc7dc9041e", "comment": "Malware payload", "value": "5751b58d5857d6bf2b1a60bb6a3e9c7ae3cb96a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766679512, "uuid": "dff1cd11-9b19-4d2f-bf0e-52246a6a5e1d", "comment": "Malware payload", "value": "75c4eddeff010a2adc83ff508141e569bf0ca6d7e62214f17393bb6b1d32056538daee920bde0c67cd4dde3f626b7526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679512, "uuid": "f2043e50-05d3-42e1-afa2-c6065741062b", "value": "T1AF657C3B7716E8ECCB274236DDA50F783771E6321A45ACBE9051E6710CE37A1942ACD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679512, "uuid": "266f5ba1-d850-4140-b4e2-0688ed7c512e", "value": "f5a30df1a05d11939f234ae8297b560d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679512, "uuid": "e338cb27-18d6-4203-a630-2a49820f247e", "value": "24576:REcqwY5Z1TIqa1wiVMnY1vsK11bp5dcR6aQQLk1wrjxI/mL:bqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766679512, "uuid": "281350eb-4e8b-4c3e-a159-c71fbcd67206", "value": 1466880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766679512, "uuid": "ce5699f7-7a21-40b2-8b97-02373d058a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766679512, "uuid": "42411cff-8b6d-4a36-bc71-06e613a9ee76", "value": "sqlite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147e1119-e1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706022, "uuid": "c2526054-5953-42d0-a0d3-9255abf68123", "comment": "Malware payload (Mirai)", "value": "383cf94b34fffd04ddddeb2221127d19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706022, "uuid": "99f33381-9727-4e58-9182-24253c84a486", "comment": "Malware payload (Mirai)", "value": "93974259ebcd822aeec49efdc83a436c58e180973823b512cdd7bc1aa5e761db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706022, "uuid": "23ecdc9a-4734-4ca4-b5e5-182b6bea3372", "comment": "Malware payload (Mirai)", "value": "efabd67f33e5401f6ba81f7aa8dc697807bac0c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706022, "uuid": "f165ae2e-9bb6-40ac-8fe4-a3fe8469a0a0", "comment": "Malware payload (Mirai)", "value": "743b5586ad34e36a4035ebd190d5f9ea0f9746e23c9116ab3847728e6ef25af92fe54ff4b3f292a352d06b6cd99262f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706022, "uuid": "ec16db1e-e65e-4831-9b37-8c8fae62eda8", "value": "T1CF735CC59B53E8F5EC26057511B6F7369E71F53A11A8EE83F394B933B813201A50A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706022, "uuid": "215de7a7-a732-47d4-9e34-d93b939c473c", "value": "1536:6vOgPsECUqPy2J826z321CX18Yl6UL2kG5qx/BsVXRR:62gUECXPhJFl18tlLLtaWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706022, "uuid": "5f07c3f3-f8c4-406b-8249-1067315b4312", "value": 74704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706022, "uuid": "2ea97ead-f39f-4146-b46c-0bb35c84d542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706022, "uuid": "0dafc965-71a4-4e7a-9d82-a7dc1cc18273", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ab3968-e154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766641433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641433, "uuid": "295774de-c7b4-4fec-abf8-126049654d2a", "comment": "Malware payload", "value": "c08209feee4fc569e2ab3f37e0d1546d", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641433, "uuid": "fda512d5-925d-4b73-a9ff-934340ad86a3", "comment": "Malware payload", "value": "93e255283db179c074c917be8e99cdd4b7aa8cc7c6eea2c811dab9ec980bb83e", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641433, "uuid": "10863340-1c6d-45e4-90e1-3e05571ebaa9", "comment": "Malware payload", "value": "c29d80f91dcc63e46e9d10da513bfddd7980cba6", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641433, "uuid": "79601894-6923-4f69-a12d-9c20ccf9a41f", "comment": "Malware payload", "value": "9c56e112f76611388392bddb7380d3d61c706b04dc7db65bcecb1fa79753120c1fcc23873a2730eb80a3e54ca045c052", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641433, "uuid": "8bc3027b-8fcf-4c98-ae12-9e6572634d4c", "value": "T16F41B570275DD6BC0AC04AE21739EE4C07304B032142FEAEFFC4C700D6862AA6BB4B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641433, "uuid": "38e03fbf-a3b6-4d83-b9fe-de52925d7fd1", "value": "48:6M7pyGJc0yf8onQMRKrL/amKwLoOV/1tMqw+RORvB3vB3Tw1Aka134yGkFa1T:6CvQ1nQMErGo/1GYwhB/BD2goy4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641433, "uuid": "823ebe87-945a-4009-9f06-03bdc85bc62b", "value": 2112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641433, "uuid": "79583059-525a-4908-9b59-213b26521471", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641433, "uuid": "91212a73-2ee1-4e73-89ce-b356ad60a517", "value": "93e255283db179c074c917be8e99cdd4b7aa8cc7c6eea2c811dab9ec980bb83e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1d67da-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766666816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666816, "uuid": "049cd237-1137-49de-ba53-ad6b3f220d81", "comment": "Malware payload (Mirai)", "value": "6aa7e7762f9eaf5746a3d074481ab834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666816, "uuid": "9c023810-bc86-40ec-a15f-adc20139cf06", "comment": "Malware payload (Mirai)", "value": "950471159f0847620694fe3c66c00e0f0c9a9f4f0daecd10d72369a390c18289", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666816, "uuid": "db981906-c538-40c4-93ec-b9ab8510dd4c", "comment": "Malware payload (Mirai)", "value": "4b6fe5effd0196870ca2e0d1778b00a34499d9ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666816, "uuid": "7e657bcc-a148-4a3a-8e23-38b33c01e987", "comment": "Malware payload (Mirai)", "value": "ea1324caf0cd3d3c6233f9837d556c85300e4b1f351ca125df3803ee7e7061d76e48ffe49f1a2983ea5e1d1bc93be915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666816, "uuid": "601b469f-b054-4629-907e-ce9861c85cfa", "value": "T19F936DC1A743C8F5ED6612B8653BF3764672E93A0129DB8ACB24BC359C16602F71735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666816, "uuid": "6b984799-2ad7-43a1-9451-f3fb5d3e217e", "value": "1536:7EuIutvfZj3HgLcwKxpeup+WE+EpJR83f0A76LOkv2RW+oiZclShVztT26BymPMM:NImJ3HgLAxpefHpJR8cAGLOkuCiZYwVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666816, "uuid": "a85d4d7a-4266-4a9b-91ec-5233cae671df", "value": 91124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666816, "uuid": "65926c95-01fd-48d4-b4f2-595defffa306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666816, "uuid": "5b3b76ea-4605-48e4-9b7b-f81bbed6fb18", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3ee251-e1ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766693955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693955, "uuid": "cce4f08b-3f32-476b-bb15-7f2c010bb25e", "comment": "Malware payload", "value": "1f466602cedc6284ac0e20a8f4f1c899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693955, "uuid": "6529b66e-9007-4128-8e6a-728d3fa58880", "comment": "Malware payload", "value": "95ffe6faf5801d69c896b62ed1c2863447ed3cf3aff1c2acf450d46ed37a0a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693955, "uuid": "308d72dd-8aec-4f5f-af98-1c521fe70ac7", "comment": "Malware payload", "value": "2000d432305297bac0ad1caaa021c15705f9da8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693955, "uuid": "43dd64f9-ea66-401d-a48c-88ad940a6c10", "comment": "Malware payload", "value": "b82e80a2df9a47d0362658d4bbf263e197c047d23618052d5b11086e0fc193d6e9ae90ee4e3f9bf7d5482f1e9de67657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693955, "uuid": "6b9b80cf-3e04-48df-847d-edeebe8e3663", "value": "T17AD2E10467F50BECF2EA07F01A16C65A7D5BB8B487B0D76C0C6121EF3960451DDE8A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693955, "uuid": "03f93eb6-924a-4102-af92-5e96c1fbaa48", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693955, "uuid": "40729b04-5f68-4953-8cb7-3b6ece21302e", "value": "768:JLgoCUoNkomWuC4a7+9CamhL70zvLuM1LZRMbxs+F:JLgo8mWVCslczvrZRY1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766693955, "uuid": "c148eb72-0d7f-4333-bc29-df4909fcf144", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766693955, "uuid": "d4055e85-df9d-477f-8ac6-78d64784dd50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693955, "uuid": "556ce6af-55b9-4a23-b27d-71466cc4003e", "value": "SecuriteInfo.com.FileRepMalware.98337239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f900116d-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766673334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673334, "uuid": "d7be4908-9478-4e67-ac05-6113b2e4e24e", "comment": "Malware payload (XWorm)", "value": "b7e8c44ad06a4686cbd2e7ae27711281", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673334, "uuid": "936e8465-fad2-46df-8c17-f50ffd335d38", "comment": "Malware payload (XWorm)", "value": "961aa29df0ecd6dbdf1a3648a18068b215810e177069948fe386013e57dc8df3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673334, "uuid": "b60020c5-f978-44fa-b78a-4c4e7ca5d48d", "comment": "Malware payload (XWorm)", "value": "5fa0e4e3d326998ea7a5b2cda2c4c014dce859d6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673334, "uuid": "63beb0e3-846c-4e19-8253-4084eb8229a4", "comment": "Malware payload (XWorm)", "value": "06c7d9169670b9f047f6fa1f952641a866c2e2b3df2e2dd760c29215b1b65716f4b41f27a6e5b27973d72fceed57de21", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673334, "uuid": "6039c182-a74e-4d4d-b04e-c852af48dd1d", "value": "T13BF41323182868E28D627CD4D31A89E9E36F41E371F15757885B5B6EB0BEB74DFE2010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673334, "uuid": "f29f576a-2dce-4042-b9ae-eb90096f942f", "value": "192:B44444444444444444444444444444444444444444444444444444444444444m:GIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673334, "uuid": "5769b925-7dfa-4b57-9641-516c0dc2beed", "value": 753676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673334, "uuid": "61c27001-a73e-4f02-aeb4-4f2c8bdb73a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673334, "uuid": "5b0d846e-df3e-4de8-aeaf-6badac13bbfa", "value": "COPIA DE TRANSFERENCIA BANCARIA_932025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc25037e-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690868, "uuid": "d18c4384-fcbc-4952-be65-ef7aed879cd6", "comment": "Malware payload (Mirai)", "value": "aef2e7ec75e64c7230a2e09938ebf999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690868, "uuid": "63fdf52a-3b14-4db1-8826-cd5c128da7d1", "comment": "Malware payload (Mirai)", "value": "9667040ed416e1ffa79f0ae95ed9dfe0339b908b3e039e219ce387211955c61f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690868, "uuid": "e32d54c4-9ff3-4e1e-b350-71aea6390305", "comment": "Malware payload (Mirai)", "value": "e02ad7f5889394ed828ad9ed07e562aca20eb6ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690868, "uuid": "2af14a6a-7285-4fba-970f-3ee50498638e", "comment": "Malware payload (Mirai)", "value": "535162a7a0915e4d302eee1b33c2fdfbdb920c2a7fbfd22537517d9a7e27e64b982aa6f2a1b035b780065f435beb2b0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690868, "uuid": "aba527dc-f246-4445-8601-4f56bfe9bcca", "value": "T11F156C26B2B3B5BEC057C1308797C6B2A931B47452222D7F66C4CB303F56E641B1EB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690868, "uuid": "f74f3fc1-dea5-40ec-9a02-b5114a0fc578", "value": "24576:VA7J4A7JEA7JBA7JOA7JAA7JFnA7JKA7JQA7JAaA7J9A7JQCA7JYA7JZA7J2A7Jh:Z7yVvx24kp32NaGOcJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690868, "uuid": "0f96a571-51a0-492d-8c68-81faa339a5ec", "value": 897128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690868, "uuid": "0661fe04-2083-4005-bd13-9be60cd13969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690868, "uuid": "dab37739-b15e-4770-ab43-c856c0661ff6", "value": "mirai.debug-release", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef172744-e198-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766670741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670741, "uuid": "20cb5a4e-cc61-42f9-b026-f286750095c0", "comment": "Malware payload (Mirai)", "value": "f0cb93974cba0bbfbe53ed21c5d599e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670741, "uuid": "dd8fd8d0-9a39-420b-9c58-af3d9cf35a61", "comment": "Malware payload (Mirai)", "value": "96cd03433987ef3831951a12aa2ac7036814e82f4344b764309b7b7ba2764e5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670741, "uuid": "888a35fb-3ad5-4a37-aa42-39573e7c0bbd", "comment": "Malware payload (Mirai)", "value": "4e733e78b1019bdedb2d9a514388a9f1fc20b6de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670741, "uuid": "687d789b-64bf-40d7-9047-78dd646675c8", "comment": "Malware payload (Mirai)", "value": "b20bc0402c54f830f53d5c1bdc7ca2e8c48ab2c1e85ac41d69f07ee31c9f0fe34964ae95a2a53a72a600afee2038f2be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670741, "uuid": "dec8965f-791c-4b8f-a96c-ecc405cb4c17", "value": "T130A31855BC929612C6D023B6FA6E018D332663E8D2EF3203CD216F2537CA96F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670741, "uuid": "eb2acf86-5fba-4c69-a135-bc991acd7cc1", "value": "1536:iW3vf438r8WgKHFAatlrat1Twz1RpQ3F1xIaF8XtMaW6qCtuHBIHOXUo4CvG:iW3H4MrjgNat8VB4OaPuHgOkGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766670741, "uuid": "c693c652-9d56-4c73-983e-ed7b92533268", "value": 99640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766670741, "uuid": "604af996-3c9a-4192-9be2-58708f1fc3f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670741, "uuid": "5fe4ae3a-a821-462b-bc8c-ede9c9947a6b", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018c760d-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665188, "uuid": "0dd7b365-a058-46c8-9d43-b29302882bad", "comment": "Malware payload (Mirai)", "value": "903911a941f7b90d309b767d3e33912e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665188, "uuid": "30a1385c-4787-433b-a0d6-305c53bad8e5", "comment": "Malware payload (Mirai)", "value": "9701197e4b6154480838b54d1e16200da5c79ec9a7e35769965a1291a15f861d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665188, "uuid": "e655c4de-14a7-4895-b030-d1f65bde91a5", "comment": "Malware payload (Mirai)", "value": "c9e94c53757cfec8cffdaadf7dbc45a71cbcd724", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665188, "uuid": "5598520e-c17a-484e-aef7-25862313ba2a", "comment": "Malware payload (Mirai)", "value": "e69e1ddd15f51c2c92a7b1d2347f6bcc9a9b31b3da09606c9941ede7c3dcc35803076b87471873d7d5e58cc132ad9a2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665188, "uuid": "c9ae764a-616b-467e-ad32-9fe3466d2ca8", "value": "T11DA33A02B591CA53C4C617BABA7F415D332277A4D3DB7302CE146FB42F8669E0E7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665188, "uuid": "760e41bf-9c44-4fb3-9a56-d958505f4834", "value": "3072:T0CUQMWlWVVczKeVu/+QM2pGqZWsJbBgtHJ/0/:T0C7MWgVVczKD+QlGqZNbcs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665188, "uuid": "dd737f99-c0da-4855-b5c1-685cd92c7611", "value": 100911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665188, "uuid": "d374e17d-05fe-4fcf-aadb-c21a622a3097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665188, "uuid": "c14d7ba3-2199-4e92-a179-ee5dac2848d9", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f38ea2a-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700886, "uuid": "b9fa6bb9-9640-4fed-ba36-ddc5b0057c82", "comment": "Malware payload (Mirai)", "value": "a18cf6206957cb1a6ccc3d0b4513474d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700886, "uuid": "12220e8f-a074-41e7-9d58-130959c97f21", "comment": "Malware payload (Mirai)", "value": "972be28d67580022d2fb0acc3d639f681a919c5ac3b151e66049f2790f47e017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700886, "uuid": "65c035ea-463f-49a5-a9d5-44411a4b4cb5", "comment": "Malware payload (Mirai)", "value": "a4d2643bc4737efc81ee449ecf5aaf764c5a23a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700886, "uuid": "bb6a6255-6a5e-4538-b97b-abf734b5b807", "comment": "Malware payload (Mirai)", "value": "6bb0aba3f9de6ba537da534c5b2e42f29b7d18ecb7b9ae84ed8171bf795a7b889b0f12a6a8a12a41445f1353621f1b32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700886, "uuid": "037fc7e1-6202-44b3-8995-871da33416b7", "value": "T1A0C36C0277180F07D6A356B02A3E5BE083FEE5D121F0BA48651F976A8676D3B1586FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700886, "uuid": "973ba319-2527-4d91-8d60-ea9bbc8f1ba3", "value": "1536:rHzTLEMz9AWuH0wEi+U3H48GhjHVaWhJ0T+EXvvpVabFZwojGgl8IE4S7xFv8rJd:Tg3zG9VauJW+AvvpV6oaT8IRSj4gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700886, "uuid": "7e9fa423-f30d-4e51-a5e5-e53b86fd2e0a", "value": 128552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700886, "uuid": "bc9a2b9c-d1ce-4bcb-8178-ec8009fbb9f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700886, "uuid": "5697ba4a-4941-4a73-bf55-39ebaf985f30", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcf037c-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626366, "uuid": "8e3f654c-64ea-4637-9d5a-c9ba04d93815", "comment": "Malware payload (Mirai)", "value": "a1dd70aa92c82060c7c6b5b2faae990a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626366, "uuid": "0bbe8e42-f66b-4f74-855f-75c33a8b8212", "comment": "Malware payload (Mirai)", "value": "97e918363b9acf7227b63497f1cb385db2ca455bc47449a09e822e2ac2bd39fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626366, "uuid": "1b5c2419-da8e-4d2d-bd72-1c1040e90690", "comment": "Malware payload (Mirai)", "value": "90fb5e84e30698773ee4f79187d07cc3f3a0e8bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626366, "uuid": "c15d0696-d173-4c16-afd7-713c60d48d21", "comment": "Malware payload (Mirai)", "value": "654ca927814260298a1d13bbf7a8690deee7d6e19a25ed4a01270b645b6bb262b294243680ca4e600c2ee3ee54d45664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626366, "uuid": "aeb9ea30-4a70-4af2-8959-043ef9db7a7a", "value": "T1B5631A85BC819A26C5D5327BFA2F428D332653E8D2EF7207D9215F15778A82F0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626366, "uuid": "a53d689d-1978-4b31-94f1-42ef41c4cbb3", "value": "1536:53X6TeusTBAPzHiue4a6OGTjXkAJlrsUTKmkYTT64:53q6x6OGTjXkAJlrsUTKmlTT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626366, "uuid": "2d25563d-cefd-40d4-a5d3-9ae81f2f867e", "value": 72364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626366, "uuid": "d98633ae-09e1-47b7-a5c9-d36c69b99a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626366, "uuid": "6cee014e-14fc-43ec-aec3-58b982843c75", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63365f0-e15d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766645359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645359, "uuid": "87c3cda6-af86-40af-81dc-fe4fe1e6bd58", "comment": "Malware payload (Mirai)", "value": "fdfba6ace1d68ea6ac909652775b59b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645359, "uuid": "ca4d6f87-05c3-45a9-ace5-c9e43caa9906", "comment": "Malware payload (Mirai)", "value": "97ff331e81d32603ec17c2c20df4bb7feb5d014714a1172b2365c4435c5da2df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645359, "uuid": "a54fd6a4-0f8a-4fdb-baf1-26ed19e30572", "comment": "Malware payload (Mirai)", "value": "4f65f6f7eea60facc8c34d58b0f3c6bf8dda7f5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645359, "uuid": "5867cc7b-af80-4fbb-8a92-9da1a781d252", "comment": "Malware payload (Mirai)", "value": "0c69deffb9f8815d010966a72748c2900d780593c0dc2519f0a5a01d28232b92b5c9e4624d48c11405dd96b6294b1142", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645359, "uuid": "a3988cbd-4dc8-4a81-9e23-8cee50a657fb", "value": "T1B1833A02771C0E47D1A25AF42A3F27E0D3FEAAE021F4BA88254ED74651B5E361586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645359, "uuid": "5be1b2cc-627b-4d9d-a48b-f72f69626025", "value": "1536:a8dLAeFQQoVpJ9dcFfmJWq61VhkIPGP+MkMVxnMkRjWxd:a8dLXcBisWP1VqpVxMkkxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645359, "uuid": "5a1ab610-a853-4bec-bb3a-181bd0d3f3d5", "value": 83356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645359, "uuid": "4ecc325e-3924-4fc8-b43c-4ba14c96a357", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645359, "uuid": "9a1364be-7b76-4201-9f68-e6394e44880c", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5522b048-e1b0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766680790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680790, "uuid": "108c11f4-c9c8-4242-b91b-b4a5bcd6466f", "comment": "Malware payload", "value": "07574349e19f38459b9960803784f006", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680790, "uuid": "48823abb-f1a6-4883-836e-4d11637992a9", "comment": "Malware payload", "value": "98b4e26831836de44851f243340e291da9ef6e40863143239d4da0ff2bc7cbbb", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680790, "uuid": "ff69ecac-64a3-4874-bf37-ab9771f973ef", "comment": "Malware payload", "value": "ac8ee1526a9135eae7dc2b2b98f4cdc473f0de0f", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680790, "uuid": "fe5c31c8-7678-4649-a5d9-dc73fec626bb", "comment": "Malware payload", "value": "1beb3ffd2fc4c6b7087e2806e37ec312cf957f668814cec7d8a56d363a72d96d10a4f8eab8c3df47f6272ba36b93290b", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680790, "uuid": "7bf1d1b8-449b-4da0-9696-8862e469d7d5", "value": "T165D623B4F35EF057E2EDB1F2B21B23A380B9154492271E9505307A2264993F97FB2F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680790, "uuid": "f20cceb9-5fc7-4b27-8791-90e79720c48c", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680790, "uuid": "1def1705-de65-4237-8f4e-75723c98710e", "value": "196608:GTHYdnvS2hOv/rWlxoPkpkfQmeChkXqsOlpCmiXseGeuTGBo:1BOHCfoP0kfQmdkj0pC/Ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766680790, "uuid": "fdaa5059-aad6-4f52-ac63-fbe14afe30f2", "value": 13626368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766680790, "uuid": "255f66ab-8c9f-4914-9f11-f10568b365dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680790, "uuid": "77422647-4835-4160-8b68-35b3caad9c31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1470661b-e1bd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766686265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686265, "uuid": "f76950c0-2f06-41ed-b565-1f9e967d8d85", "comment": "Malware payload", "value": "e7c3699066c48bad84262fa31d704e1f", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686265, "uuid": "abf885c5-baa8-463f-a0ec-aec51df5686a", "comment": "Malware payload", "value": "9a3f15daaafd75dac5c3ab99538ba22f9bc59aaa631e0df5d84cee3ebba41c4a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686265, "uuid": "21a4356d-4737-4c32-80df-59dd703454a1", "comment": "Malware payload", "value": "d6c608a135895ee8ae2f79701110d2062d83123f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686265, "uuid": "5613d805-7ced-41f3-b871-e215f5e29f98", "comment": "Malware payload", "value": "6db69465c85ee1da4aeed1dd0c2ed83ae3b2692d93a7f09c29ba1a6ac8f2f7947ef41bf07cbcdf108fc0e8ed70b31e48", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686265, "uuid": "c1a0a533-7957-408a-85fb-7e0b440d9287", "value": "T123E1AF89EB6A59F9DABC20F6497DB8572A719B34787564F0418C08AD56CC4CF902EA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686265, "uuid": "3ffca93d-fafb-4a91-8421-239598c411eb", "value": "192:vRxk0cTSfH16pgDA+pqLzq/Ti2YQXiCUst95RR4NN9l:v0dBAAWqvCTxxXTt9D2Njl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766686265, "uuid": "005593a2-a768-4127-aa14-785a36d86034", "value": 7398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766686265, "uuid": "6edd211c-4f43-490e-90db-956fa16f2447", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686265, "uuid": "cc24b54e-69c8-408b-b90c-835ba6a165f5", "value": "1_11_2_1984_25.12.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7461f7-e168-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766649849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649849, "uuid": "af2bac1b-ae0b-4965-8e7a-4af0c21a8c7e", "comment": "Malware payload (Gafgyt)", "value": "ce42d497d11ed61be9dc1ce58b417048", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649849, "uuid": "0780b9ab-0e76-44ea-842c-fade030af2f1", "comment": "Malware payload (Gafgyt)", "value": "9ab9f9bf8364e6f822e831e5fbe9611d6a5c09e9c03e173e5004d47c3cb4ff68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649849, "uuid": "819e21f6-4dfa-4b4a-83e1-4c94eed17b15", "comment": "Malware payload (Gafgyt)", "value": "f8b6f92b2c38529b853a402e82145d9fe367c18a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649849, "uuid": "d7da9f0c-c019-446b-a60b-be1927264fee", "comment": "Malware payload (Gafgyt)", "value": "5c3cba707931cd74a2d7bcb85f7da6c67a6e7a58d1c7514f1e8784fc08c48f7b546b6dedca8a91e24e143a2f5384787b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649849, "uuid": "52ebbe9a-c601-4e69-9385-1b9a6ee35420", "value": "T1C8D31A05E8544B23C2D2677BFB9E878E37319BD85BD7332256256EB02FC26482E3E550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649849, "uuid": "21ffd6be-359b-47a8-82a0-097ab350e407", "value": "3072:UHHy6TuR/dxNjZVhKdbZ6HvtKJrF3cUXOQUrlK1R0tw5hEVy/EfHZi59UWPqmcQR:gHynvYLceKrlK1RYw5hEVy/YmcQNdLeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649849, "uuid": "07ed7fdd-c8de-418d-a6a8-fe92190e7b0a", "value": 138634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649849, "uuid": "c3427c0a-d8f6-4371-9923-93a2e450b85f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649849, "uuid": "2f41f819-51da-4e9a-b461-7bf212445392", "value": "i.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42a4e86-e12e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766625222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625222, "uuid": "d35fcf68-b7c8-42bf-9be9-d9ccd9022843", "comment": "Malware payload (Mirai)", "value": "d92ba823538709aefcd24159ab9501a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625222, "uuid": "3290b80d-4d04-4a03-b765-ff4eee736067", "comment": "Malware payload (Mirai)", "value": "9ac3827ca975230cf13e752cb62becbe2a8e882fc836b3ba297915db7f89b9cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625222, "uuid": "d12cd26d-35ac-48a4-aa27-341ae469b890", "comment": "Malware payload (Mirai)", "value": "333d5c2fad69d67046d8b0b02f6cf7f75ab28c11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625222, "uuid": "f8430604-6742-4eb4-b9a1-0481ec6f47af", "comment": "Malware payload (Mirai)", "value": "f6e5b9a174ab59b69b5dbae0ce52dbe2de5a21595b5de7c27acfbcbe65254411954650c81cb5a65a8af7afaf5c13534a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625222, "uuid": "7cc9a9eb-c585-4dd3-805b-7b39b755200c", "value": "T1C8635B4272180A57E4621EB0293F2BE197EEA99021F4B7C9740FAF5E4672E331446FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625222, "uuid": "70248c9e-6801-4710-b10e-c997117c2fb2", "value": "1536:iXjEJq5Dj0EN6kHFD97wWVoSJhnH2fYyc0iT6v:iY0CEDD97mSJhH3bTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766625222, "uuid": "b8bc8ae2-7e2d-4f2c-9089-4d1b691d5b87", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766625222, "uuid": "00705175-b980-4db8-aedc-7fb8e2e8d986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625222, "uuid": "44a38e52-993d-4b92-9eae-a771c5378a3b", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ee3529-e12d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624692, "uuid": "5e3356b1-5392-4b89-9a63-41fff27c4fca", "comment": "Malware payload (Mirai)", "value": "e78fa9b78d86f5d8e261557b07fde3ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624692, "uuid": "b67a791c-36b8-40b5-82e7-bb82e9fa1820", "comment": "Malware payload (Mirai)", "value": "9af0a672cd6621a086ea0b8f96989210ada8cc8ad3745f2af45a78f3bf7c0a45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624692, "uuid": "c5f7aaf2-77c4-4eb7-b593-bcd83481d785", "comment": "Malware payload (Mirai)", "value": "9d08ce6d18e861c7b0bc52665f3ace252deebb5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624692, "uuid": "ce89ad3b-ca23-4c09-a92f-285529d0c04a", "comment": "Malware payload (Mirai)", "value": "9985282fdfa2c01d612ed030461e46bd8c57742eed5c3c8aed6bd02c612f3bde093a89e75b38a141c4555ad154d60f9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624692, "uuid": "85b67491-f2e6-4b42-9022-129463e474df", "value": "T172734A2179792D27C4C4B47E61F30735F2B62B5A25ACCA1ABDB20E9DFF155003107ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624692, "uuid": "22266b92-849b-4e17-98a5-a1ca40f403d5", "value": "1536:yyEySFiG5q1ccrGifgy2pVWNdr01Xi1YQjeOPU8YXyzaG:yb7l4cG2v5oYQykxzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624692, "uuid": "26ef9896-e6ea-4b19-b221-c573020e6510", "value": 76844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624692, "uuid": "373da9c8-d003-4956-a95d-4936bd79a40b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624692, "uuid": "3ccb590a-c5ce-4d66-bea8-40ec5776c706", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d66e2f-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690155, "uuid": "99921b7f-5596-495c-a6f5-9c2e5c9d3065", "comment": "Malware payload (Mirai)", "value": "a34d91096d2d6d9acb2e07f64a0cce0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690155, "uuid": "2584ee33-4b75-4d9d-b0a1-35187ff70b7a", "comment": "Malware payload (Mirai)", "value": "9af350598748aa5a4bc75332622b936743d1f2f78a986b8c5d7ab7aa0e3949d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690155, "uuid": "2fe960f2-cbde-4a89-884d-2451e11c22df", "comment": "Malware payload (Mirai)", "value": "be469bc2a2a16c7c15ed901a9f310afe97973109", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690155, "uuid": "6f6b2a41-ef57-4760-bf05-3b5017c90c6c", "comment": "Malware payload (Mirai)", "value": "01404d76f1d8c3f0c2cb07e1d2eddfc47c370cd313a4e86684da3e0755fa851d5604116884f9ad4b5a56087cea2753a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690155, "uuid": "97d74673-3fb8-4423-9318-1c004084623c", "value": "T118B4BE67F67A1D43C8E39A3E45A7C2684323D24A17929306A30EF57D3EC67394F1A6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690155, "uuid": "73e04a1d-802d-48ba-bdb4-835f361d5bd3", "value": "12288:CV2djVlcGmMJ0dBE/7WLis5gp480/BwjdHOTtFKukz:xdjncGmU0c8LOHOhFKuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690155, "uuid": "e2147111-cebb-4182-9199-341f27ee9b44", "value": 514440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690155, "uuid": "7bb41ce3-6fea-49dd-a6de-325b79bc5818", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690155, "uuid": "04f08630-e41b-48d9-89ca-5f39665d4873", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8ee496-e132-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626684, "uuid": "e1b1e41b-73ec-47a9-8f7c-89b162107c4b", "comment": "Malware payload (Mirai)", "value": "71cf4dd49747f5d129d2d408fb914dcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626684, "uuid": "3d6f6622-0bcd-4760-9803-56a603c851e4", "comment": "Malware payload (Mirai)", "value": "9bf1ed9a3970d8113edcd39a968a137cf94486d8c79e9690b90728fe335de323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626684, "uuid": "1a7faf74-f7d8-415b-8c03-f3239770173e", "comment": "Malware payload (Mirai)", "value": "51270efce62e845fc2f6d5c189b93582edb74a7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626684, "uuid": "7f35e1f0-0c11-462e-b9d1-2eeae4a08688", "comment": "Malware payload (Mirai)", "value": "5e56571b379056b73e4c2c8b50ab982bc3cbf61c83c711d66af28ba8558b45dde73bdcb005cba87db32f1216d85c2cee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626684, "uuid": "17d7aa8d-ef73-460d-a40c-3c7c846b8d75", "value": "T193732985BC819B26C6D5227BFA2F428C332663A8D2EF7203DD155F15778A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626684, "uuid": "627ed426-be0e-4b17-aadd-d9ee475305ed", "value": "1536:KN+CawkberI/HyLeQHto9LnYkAJYDq0P0DMLWLbMBTw:KN5fbULnYkAJYD4DAWLgBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626684, "uuid": "3d82b04e-516e-4c9d-92bf-9c334855a221", "value": 79040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626684, "uuid": "3c5d9579-6dde-4819-a4b4-72a86da9f9d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626684, "uuid": "a43e2389-f5a9-42ef-9af0-3a37b0d47f56", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e6710b-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700891, "uuid": "9f610579-6a22-41e7-91fb-a58db44c4073", "comment": "Malware payload (Mirai)", "value": "8068334fc031ec928db5ac0458d0289a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700891, "uuid": "c6f8fee0-183a-4d9a-a31d-65ee74ea9beb", "comment": "Malware payload (Mirai)", "value": "9c1364fbaaffbaae1d5b0d0b19cc0f7fb78560ad89bb5a476ece9dbe33db024d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700891, "uuid": "e44870cd-d925-4b2b-b10d-d5d2c2f826ff", "comment": "Malware payload (Mirai)", "value": "e6806406f3e3bba93e424bf2671737738fd49cfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700891, "uuid": "e13ba8f1-c27f-4a37-8027-a1954adec344", "comment": "Malware payload (Mirai)", "value": "9e4d4905b8990fef0d8de6f1d327b60ed41d95c1c5ca6088aa8c7bf2d2680b651907fb27eaf1babc165318b98cf28d71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700891, "uuid": "5c7d291d-e179-4df6-b6c3-bd06aa2e5b97", "value": "T18EB348D0E243E4F4ED2641342277F73B9A72E5750229DE93E3A89B327C92B41D90639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700891, "uuid": "0aa2ffca-fa44-4285-b516-9d5346655614", "value": "3072:SeodrnS+F86gQ35gFgvKmx+b+RWLemUgj8OL2uk7o3RuP:1oVnSa86gQ35YOKmx+aEyUEAuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700891, "uuid": "d9e15390-bae7-4074-818b-aa139ef38ab9", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700891, "uuid": "1dd4c5ee-93d5-4874-99e5-c4eb972f1b96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700891, "uuid": "21ca3307-da5f-46d2-9985-590f8c324469", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c412e7-e132-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626680, "uuid": "e5b84c71-4e6a-4d95-8a2c-a9163d5f5beb", "comment": "Malware payload (Mirai)", "value": "0896a583c3669a30b4143f9d22481e05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626680, "uuid": "b0189f10-2d03-4e74-8712-c793d96ff9e3", "comment": "Malware payload (Mirai)", "value": "9c9fc24fa2c11a407064a98b5adbc5464f06ce9b595915fbfb180eea4c8a67aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626680, "uuid": "16a778a0-d22b-4a60-a83f-beecee910e31", "comment": "Malware payload (Mirai)", "value": "0cd714291ef1a997ff9f14e440a81ee6e82dcbcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626680, "uuid": "32206840-17b6-4986-b149-79d4362d9b8b", "comment": "Malware payload (Mirai)", "value": "9016e2073f44da9e86c9c87cb9cff83e38e09ed8e4e3974187a72be32a74fe64581c778e15322d753dbd4f71d5d8d84e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626680, "uuid": "c24b82c0-2b53-432f-95c0-2c714b82b1d5", "value": "T17663C81E2E268FACF769C73547B78E219B98338736E1C681E15CD5006E6024E645FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626680, "uuid": "47cd963d-59ef-4532-a1e7-39a3135c9ed9", "value": "1536:hSPPIxtcNzMw761nu1J8u11Eg20Cl1uTu:hGIfcNrXHC3uTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626680, "uuid": "d12b18bd-be5a-4e10-9c2e-73dbea4ed103", "value": 68216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626680, "uuid": "2d76303a-edbf-4ffc-ad10-e5b0136ca82c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626680, "uuid": "024cee9c-305e-419f-8e14-8ff482ba1a31", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce174c16-e1e8-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766705045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705045, "uuid": "a9d77b67-6f2c-4e81-bcab-0a67f07ee2a0", "comment": "Malware payload (AgentTesla)", "value": "c7cd4eacfb7def370e8717e3d7b286f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705045, "uuid": "6557b54a-9efc-4fda-9c1f-8f8fb138b676", "comment": "Malware payload (AgentTesla)", "value": "9d001da76d3a9a241bb5c8d899fdbc8095b7efcce2327d8612449ade86ad5702", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705045, "uuid": "a2af4ac7-fad9-4cc5-8b0d-cd32acf9bd96", "comment": "Malware payload (AgentTesla)", "value": "0ab4c43fd5eab8a62793ce2880053f32a1e2612a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705045, "uuid": "a0d731c9-cc24-4a73-b363-2996f0b591e1", "comment": "Malware payload (AgentTesla)", "value": "12c6471b901bd34350e328cc147b471818347b38ead6a3f72e12c02680cd6ed69c95f5bc7991c82f8e76807b1e474137", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705045, "uuid": "14ab13ec-f2ea-476f-873f-d9402c8aaaec", "value": "T10C156DED076769933151E34B12A3D702304E6EEFE005B78FB3EEAE24D6BB589440E585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705045, "uuid": "031e7d8e-6fe9-45ed-81ad-8c75b9ad38c1", "value": "12288:kS94i9wep2XLTjqPHN8swV4qS3GvTAeZ8XwBT9d7naFs8yfG3WnJoJpj3aUg+xp0:kS2iyRl7l7n15J7afNGge5SDXZfSdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705045, "uuid": "7064a044-e410-4d28-a626-0df624121d98", "value": 943660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705045, "uuid": "66af5d32-a395-45b3-ba47-b8088a55e263", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705045, "uuid": "73ec5ce3-ca93-4310-810e-d6f8ccd949ab", "value": "mommauyterdtfugfytrtvybunkutjyvcrvgvjfguhbukyvtdfguhvkytdfgyuy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6363ba48-e155-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766641730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641730, "uuid": "83c88ad6-b36c-4ad7-9771-70f6ddab10b1", "comment": "Malware payload (RemcosRAT)", "value": "ae28250e82ad1cf102d0ae6a9cca759e", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641730, "uuid": "63997094-86ba-43c2-92cf-ebc742a6b018", "comment": "Malware payload (RemcosRAT)", "value": "9e767325953e45535cde37f767e24fa6ee1cefdb8ef97af675f3ab679e26fe3c", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641730, "uuid": "7e121b86-98b2-41e7-baa8-9574ab153da1", "comment": "Malware payload (RemcosRAT)", "value": "aa4ccfe9ae0ab3af1f23fe5688a5d2f5f86e1d6f", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641730, "uuid": "f215eed7-81b5-4f3a-b1e0-d441f1d2bc10", "comment": "Malware payload (RemcosRAT)", "value": "ce38ecb598fad158c3448618e3065387bf1e114ca22068ef619abab0dc9247fef11bd686547731377e477583b7e784c5", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641730, "uuid": "b5a1cb96-e55d-47ca-99d8-7fe7f906ed27", "value": "T149D47D95B3D441F4D07BC234C9C3451BE6B2B8056670462F03EB5A6B5F237A29F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641730, "uuid": "f435ae61-41e3-4511-a732-201b73f04773", "value": "8b3e0763eddbb01367bd21396e110071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641730, "uuid": "cfd81bec-d74b-4b71-94d9-9f7378d8ef0c", "value": "12288:1aMwmp7scoHvln/+iB9PQoYYUPGm4Eou5uFyWD:E7mScoHvln/+aPQoYDPGmH3574", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641730, "uuid": "63a3588a-c27f-4691-9047-b0f9f4056ef9", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641730, "uuid": "3ba68757-15ef-4754-96b5-59ed2cc34837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641730, "uuid": "a25423eb-9a51-4472-af48-ce5379ba779b", "value": "9e767325953e45535cde37f767e24fa6ee1cefdb8ef97af675f3ab679e26fe3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b90ed5a-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690330, "uuid": "ccec0f75-f69d-46d6-855d-058e62a808b7", "comment": "Malware payload (Mirai)", "value": "a4a3eae4b1b1b77307bf8652df69a639", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690330, "uuid": "6855309a-97dd-42c6-8695-be24755edac1", "comment": "Malware payload (Mirai)", "value": "9f45aa714e603901aa6c7627fab86a1def241ecb30dea3575fbbb8c8269bc4b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690330, "uuid": "4e37aeba-a559-4ba2-a8fc-29bf4a6b6b47", "comment": "Malware payload (Mirai)", "value": "2290d549f7b7cbee7433ea0353170cc6cb583537", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690330, "uuid": "2d4da164-fcf2-48aa-996f-ee291547eb6b", "comment": "Malware payload (Mirai)", "value": "2999f5b6d77f2d065cf52d87e1e8952969f84407d5382ccbcdb1331bc87c9237729b4fdd260a6a78fb55acfd3267a2bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690330, "uuid": "5fb50b8b-5a57-4cf5-b8cc-600c182defb7", "value": "T10F21D1CF21910FB148488E0CB973841855C6A9D4FC422EEC168E19764D97B78B62AFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690330, "uuid": "8adae792-43c6-41af-9dc6-109e91708ee3", "value": "12:oF1iHWW5hbSWWflwWW29NIl56WWQCa0LKbWW1NgOyWWjJiRWWZO7fWWWSvSWW9Nc:ygMl1NI74KCdiWQA2Nt6dO0PNf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690330, "uuid": "36c93b3a-9571-4cd1-bdda-9ef87d660a36", "value": 1121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690330, "uuid": "7b146040-7911-4d5f-888b-22d7c0088e1d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690330, "uuid": "fdc78f21-f5dc-4aba-8096-d9b1497ca852", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5393bd1c-e1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766705269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705269, "uuid": "82acfccd-17d3-4fb8-9f37-da309377be27", "comment": "Malware payload (Mirai)", "value": "6b7b68b6158ad22d90e6d16765a622d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705269, "uuid": "8f98cc01-d23e-4a6d-b0f3-99cef4d005d9", "comment": "Malware payload (Mirai)", "value": "a023212f1f89d4e9040276eb13b89cc59f4848249c672840b1fa0da9a6b9de31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705269, "uuid": "bbd4c929-f250-4f5f-830e-aa7284c21e6f", "comment": "Malware payload (Mirai)", "value": "609ff0e94cedf3d360b3c942757ee9f72c67ff45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705269, "uuid": "cf79918e-ab00-43e2-a7cb-b1bb17c2a82a", "comment": "Malware payload (Mirai)", "value": "5701c90b009ded81dc6d37814f0b5925e9e070d149267837f318bbbeec1800d4876793a55eee8349b0eb33b84ca615dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705269, "uuid": "7e092da6-8943-42ba-b8ec-9d1e3802b28a", "value": "T18D43F120C705BFA5FB7B9174F426909233AF0AD5F2AF63C0D6394F3269D840B61A9593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705269, "uuid": "a76023e7-9857-4a98-8750-195c9f3fdd20", "value": "1536:Bin4/vjvlGhKHhbLf1WN8WyIXp9vZErRJV2:m4zloKBeNyIXTvy92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705269, "uuid": "e8ab37d5-a69f-4bba-914f-b4fe279a7e33", "value": 58712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705269, "uuid": "317798ff-6e17-4890-9738-7a95d4d8cb57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705269, "uuid": "1e1afa52-ad85-418d-a8fe-c35e894ac0bd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3246f19-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626080, "uuid": "0350124d-c44b-425f-88f6-f2285b44f6fd", "comment": "Malware payload (Mirai)", "value": "588fb0f0b03884ff103816ffc78d5eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626080, "uuid": "f6a7f71d-f78d-4a67-876e-8cb1f0a7052d", "comment": "Malware payload (Mirai)", "value": "a05621105654ed8765a3c2b240d7c5118929cf915f6b9374fc62be50df2d0bfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626080, "uuid": "0abb2195-5b12-4857-9590-4de29ad39000", "comment": "Malware payload (Mirai)", "value": "3cae95d972ffbb12f8cca5f2e7bde7c00bc2567d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626080, "uuid": "ffb9095c-6111-4eb4-8c73-22deb4d41c09", "comment": "Malware payload (Mirai)", "value": "030aba97def53fa8b7a3bc01bc953c3ad8da238b51c7679108708e350a3d8561f6d3b4a3a1489943c855e35eb43c15c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626080, "uuid": "b5c2b4d6-0244-480a-9baa-639101e7fe4d", "value": "T1D124284ABD81AB11E9C525BAFE5E518D335307ECE3EA7102ED105B2D66CBD2B0F3A411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626080, "uuid": "9c560ac3-aa3c-4d5d-85d7-ce0ba07fa826", "value": "6144:2Dmx96ziOYsZWPaCIXDmx96ziOYsZWPaCI:2DmPaiOYsZ4aVXDmPaiOYsZ4aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626080, "uuid": "4ad7a7a2-06af-4e99-af27-d6f37cc4539f", "value": 213864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626080, "uuid": "1f5081e3-3e61-4ff0-8131-5a5761a6ddf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626080, "uuid": "00253793-d5c5-42ff-81c0-31028e229260", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce4693f-e178-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766656698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656698, "uuid": "01fe6b35-8d2e-46ce-8ed9-62e10d0d2ac8", "comment": "Malware payload", "value": "df3f0c5380a52d6313b634a2e741cc45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656698, "uuid": "8686dda4-7943-40d1-bb63-8fbce493861d", "comment": "Malware payload", "value": "a08bbfe1428ccff19c582fdfb0d55ee2bc262caf59048a50dc0da5bf21a00d91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656698, "uuid": "0cd2b802-34ad-4f77-a8ac-6450e979fb66", "comment": "Malware payload", "value": "1a29c3c58dae3bce7bb943e31e7ca09339898d20", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656698, "uuid": "8e076ce3-dc70-4d55-a76d-7a3ca8b12838", "comment": "Malware payload", "value": "2e34f91355741507ac949961f22af0baed3670988b2d0e088ad38996eec136eaf20688988dede1a9d3449a12fb52b194", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656698, "uuid": "40c280a1-6f94-4b7b-b0e7-e6a2ed03fb9b", "value": "T1EB119ED921905C3948EACC0D32E58808963BD58979619F2DDEFD442B40E7AB87F6CE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656698, "uuid": "0eaaa942-c8c8-4a21-bce5-a617ca5254ee", "value": "12:Gw3XHNIBS+CoKSrVxHX+MYl9AXY9o3TxykF66hyrQkn:GSHNIIKKSrL3zYl9AI9WhdOQkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766656698, "uuid": "3e1a702c-6bc8-4129-b012-ad5e5067df32", "value": 935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766656698, "uuid": "198c2786-fbd1-4116-9573-60c176a09651", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656698, "uuid": "956223a2-c42b-4e20-bf1f-2e8ca79dabb9", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4864eb00-e168-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766649845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649845, "uuid": "bef34d5f-fc45-497f-85e2-e77350316364", "comment": "Malware payload (Gafgyt)", "value": "733009fe89ac5b0b0225f9923329c802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649845, "uuid": "09a06be6-dcde-46c0-a35f-ccde69b77d83", "comment": "Malware payload (Gafgyt)", "value": "a0d426e272559427d65ee72a20eb0693019d79d68b59c4d2d9c5af6523903023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649845, "uuid": "f8ed0e64-1189-40ea-9061-241384c6b685", "comment": "Malware payload (Gafgyt)", "value": "ce79aa0717eaa5d7bc4106eabec522d84a873941", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649845, "uuid": "c287baeb-c193-418b-b113-01cb9d0373d1", "comment": "Malware payload (Gafgyt)", "value": "81d2648ca1c9bc3b49b335a1b0c1bddf7357b40f88001684953e7be9e1b4b415b7b629a38fca37fc26f9d1df1fbd62e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649845, "uuid": "f668377e-7aa9-4300-ac0b-49ac80f1ba68", "value": "T121F3A717F7608FB7D80EDE3306994700208DD59922B8AB6B77B4C61DBB8654F4AE3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649845, "uuid": "0a8be0a1-6942-49f8-98d2-b9441760baf8", "value": "1536:hz85yDhQJ/ZejY2hhEU/0TZ3irhQIfHd0HTgjJ50hUoqpZKi5h/c7giTUw8QLFp+:S3PBIfnmO5h/csclppQmK13itKbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649845, "uuid": "e52218f0-3ec8-4b82-9541-3e535c14a07e", "value": 167205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649845, "uuid": "ec68bbcd-80bf-4d65-91ec-0a67c5866dc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649845, "uuid": "45d837ed-f1c1-4c89-b8ee-4d9cb553d6d5", "value": "i.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b2c40a-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1766673277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673277, "uuid": "ffb7ac70-fcbd-4dc6-8643-ab6604ac7a15", "comment": "Malware payload (PhantomStealer)", "value": "d9c6f4f6b29692a4b4532e55bc8a70c4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673277, "uuid": "2c77426a-6365-4842-a84c-779b1f3d37ed", "comment": "Malware payload (PhantomStealer)", "value": "a0e5be7dee0a71c5a3ca4fe7466b9511f0489ebec553c36ce5a6ee5b9e34e024", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673277, "uuid": "b2112ea6-9ca7-42d9-839f-7ab2230d9d27", "comment": "Malware payload (PhantomStealer)", "value": "ef39dc61aabd31dde47d2e7da4171057db350c83", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673277, "uuid": "e477a914-8845-473c-a59b-667566b4f304", "comment": "Malware payload (PhantomStealer)", "value": "af422f797745d2838d4e1480096d507e0184df4667a8b6d76a9b84ff7049cac18d387d0448b291f1cd0ff0b5ab0ded81", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673277, "uuid": "2e63ce0c-9ec7-4340-8255-216e50f36080", "value": "T1850324C93FD3F87053766063692FA0DEB2BE0C94760C4195DBA79890BC2C718E6A5E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673277, "uuid": "7316b535-035d-4e3c-9593-b561870c7c22", "value": "768:pWzUyk4WDz21gvINNYtVh86yRo43q3KyBx:pw9kf21gvINNoVbi38KyBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673277, "uuid": "9bbd3870-def5-44df-ba21-263add2ac5bc", "value": 38916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673277, "uuid": "3034ff84-b640-4f8d-869d-6174a47228e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673277, "uuid": "2606a9c0-5d84-449b-be99-04095ecda9b9", "value": "DHL EXP. DEBT WARNING LETTER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db25ec05-e19d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672855, "uuid": "e01e69de-bc67-4d2f-a6dc-d2ba35a865df", "comment": "Malware payload", "value": "1457c5adad926c1a8f33accacab9221b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672855, "uuid": "8a19bcf5-4258-47d0-90b3-61d0c9572910", "comment": "Malware payload", "value": "a1243c0ef77f8bed3c26832be5308ccfa6b7df50f6cdcb776021091c2ef7b2fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672855, "uuid": "4cebe712-e8c4-4f0f-b5a6-316f5f4e0976", "comment": "Malware payload", "value": "f2ea0295e6e1038af9c59021e7a5dcd19d01b4ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672855, "uuid": "5b6f3e0b-c0b4-429c-a17f-344a233ae853", "comment": "Malware payload", "value": "430a22ad8da011be2b49923fdf2aece001e4b47b378dafb1cefc32acd586fd452440c140aceb2c1b417b1482a37c0e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672855, "uuid": "fb18c1e6-ad29-4d75-90c6-b4fb5188141a", "value": "T1186733E9021441E4E9B47BB8978FB0DC8B85FD954E43BA246E09D0EFC978CE2DA54437", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672855, "uuid": "85bdefb5-b6b3-4da5-9b4f-9318cf462ce9", "value": "d8b25d9f6e4502eb253a30096c76cb14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672855, "uuid": "acb16bd5-6291-4ca8-a841-829b10050023", "value": "786432:sr+dqyftxcyy8rDmc0UcOCpTqO9m9yuPmlszm:s6dqyftiCAPTqO9uPyQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672855, "uuid": "847033db-5262-40a5-b91c-1186ccba00bd", "value": 30894975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672855, "uuid": "56f35947-59ac-45d4-bb1c-f2e5dd763924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672855, "uuid": "33b35693-8e53-47f5-b7f2-da29bd6b888a", "value": "SecuriteInfo.com.Trojan.Win32.VMProtect.27681.4703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7eb088-e15f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766645908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645908, "uuid": "dc3099dc-9c45-449f-a86a-af0c4b5b5d28", "comment": "Malware payload (Mirai)", "value": "445001b7bf0d78444be45eec1e9c4e58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645908, "uuid": "f6883548-f864-4ef6-87ab-8e310b99a140", "comment": "Malware payload (Mirai)", "value": "a16cedaed50c21b550b537c66b6c2100674fe903994ed14e13622578ad58e7b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645908, "uuid": "3286fe88-8647-4469-ac62-ae456a9d2056", "comment": "Malware payload (Mirai)", "value": "5125d3bc9b7d58f428df164d0bb9bf6c96461939", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645908, "uuid": "879f49c1-fa8c-4662-800d-f4c5d97b928b", "comment": "Malware payload (Mirai)", "value": "6c425c83eef9a5d29d6f7bc959dc76ea745f7987750abf773160ef7e8672b0b168fa4887185192e08cec7c22167a770d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645908, "uuid": "587e2757-3b1c-46f6-837d-78d93e3eb9bd", "value": "T160735C42B3180A43E5634DB0293F27E193FEA9A020F4B789655FAB8A4675E331447FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645908, "uuid": "acf5305f-02fc-41a5-8f3c-d6b81c27a703", "value": "1536:Ry6PrqnJPNBIII8qge4VWW9dGda4P7CpfTwt:P6vXqgew941PMTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645908, "uuid": "46ac5966-20d1-4a72-9c91-eee444ef6e02", "value": 79140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645908, "uuid": "22ce8e29-e6f3-470b-9aec-cc665b56dba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645908, "uuid": "511c8a23-e4eb-4381-847b-c770a69f4b19", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e666c0-e16c-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766651698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651698, "uuid": "00d5e4b3-9ce8-4167-a5da-bb4d14d67505", "comment": "Malware payload (QuasarRAT)", "value": "1f008dc0b571dea9feb7075328b3c7ef", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651698, "uuid": "b6a83e3a-f76b-4382-9800-2086ffad59a2", "comment": "Malware payload (QuasarRAT)", "value": "a199f8afe9ccc0cb9f95f8958b51521f9850f287345380012d034e0a6014e8a4", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651698, "uuid": "891ec7cd-5948-455d-9458-de41e110e7e4", "comment": "Malware payload (QuasarRAT)", "value": "488d1e7f2de60b2bea3033e17ed227b1d4d5ff97", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651698, "uuid": "d6c6e3c2-2d53-4c76-b0a5-0cb4796bd59a", "comment": "Malware payload (QuasarRAT)", "value": "d4d01bd1bf752155ceadc368d6be7f212aeb1c9e339470b1e3d1a4a7172106c81e7a9905457fe39247d4afdacb727197", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651698, "uuid": "a3d071ea-3c8d-476e-9850-9d19512f86d8", "value": "T1CDE55A143BF85E63E16AD373DAB0501663F1FC2AF363EB1B6191667E1C53B4058026AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651698, "uuid": "9c7005c4-ebd2-4211-9e59-5c2df3738ec2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651698, "uuid": "457c5b88-e177-476c-bf67-58865b519d6c", "value": "49152:Ivrqm2srax5MlP1lTsypIXXsYtqLYrMMfULoGdBTHHB72eh2NT:IvGm2srax5MlP1lTsymXXsYtqLYrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766651698, "uuid": "1dacda83-aa95-4580-a95e-d1f537e182bd", "value": 3267072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766651698, "uuid": "dc804078-c49c-4586-883e-13e749c22a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651698, "uuid": "c5678dfd-5f87-41d9-957e-7b134e6f7dc5", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340d7cb0-e181-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766660548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766660548, "uuid": "b3c3d3cf-f6ae-4e65-835f-45caa957b31c", "comment": "Malware payload", "value": "4a0823bbc3c115f238e147911dedd9ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766660548, "uuid": "b3cd91b2-fdef-4f6c-83c5-1f3946fa887a", "comment": "Malware payload", "value": "a1a114fd875bd6f96d2ceeac2b98596c0ac56d727e4bb970becb2466cec40086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766660548, "uuid": "33f3f3b0-db1b-4498-912f-e29a7a4fe019", "comment": "Malware payload", "value": "777a753817488839e63b7e07c1247d9259e446c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766660548, "uuid": "fbbcf809-eb54-4823-b779-3072d0ae0c70", "comment": "Malware payload", "value": "a39c6a70d1b9d864fe656c1567d2f43ec054ee37705c8aa273c7cb5b9f935f24bf0f6c1cbd974bad6e84570cba31ca55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766660548, "uuid": "ee8ed95e-6e1e-41a6-994a-61de994e9405", "value": "T156642A14178CBD0AD59EAA33C8F6110C63B5B0B5E4C7CB5B5940DB681FD1394AE32BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766660548, "uuid": "9d205f55-8b3a-4cfb-b2fe-b5462ddeaa21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766660548, "uuid": "58036289-4dd0-456b-9ff3-e9dff4120174", "value": "6144:NDrhbfRZPYXOxeAkUKCuJoLY39MPO7xR72RMP80f9BeFWLmPl/ejqm+Wy9M:L8hAiCwZQW7ocNLmdV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766660548, "uuid": "df355c4e-a974-4d4a-a935-d0b7648f5cae", "value": 318960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766660548, "uuid": "33d76857-5358-43d5-89d7-6bce32b43ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766660548, "uuid": "13103c4a-8b46-4c44-a21d-4537e685f2fa", "value": "photo202512256987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5750a45c-e16c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766651588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651588, "uuid": "3efd1037-408b-455e-973b-3f2a9f1f429c", "comment": "Malware payload (AsyncRAT)", "value": "d10411fe1e339c8c98406d546c8d0c7e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651588, "uuid": "cdd78838-8581-470d-8d16-c85993bab7b0", "comment": "Malware payload (AsyncRAT)", "value": "a1df14950e5815d46cd6b6f44ea5091a4f03d828a0cc84861d135039f47ab2ee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651588, "uuid": "5b41cda6-315d-4788-b825-e8f61eaea90b", "comment": "Malware payload (AsyncRAT)", "value": "8e7f678c7c9fbc5608d16710fce26d63d239d6dc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651588, "uuid": "b32baf5b-e1fc-47b4-a2d2-46b5f02a084c", "comment": "Malware payload (AsyncRAT)", "value": "6bc94b4d0eb108a6c68d6e9958fb0aa6195016feba7d652db67e4d0081befaf3d95d8d0ce65470f048976d9bf80eca86", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651588, "uuid": "473ff4d0-06b1-4ac4-b89b-5aabfcb1e3be", "value": "T1F1534A002788CA65E2BE4AF4ACF2550106B5D9772106CA5E7CC405DF6BAFFC64A127FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651588, "uuid": "a1c8d5c9-acb2-46cb-a88b-3f16fbb7868b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651588, "uuid": "37970ea3-6603-4ef5-a313-002dcf1905dc", "value": "768:vfj56pqzNiPvafiO9J9f+7RVfcp8wp22U74jXy1+VSCv7mqb2nppwL1og5D8GuhI:vRz+AGN9c1PFGLGbbYwLAGuhVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766651588, "uuid": "adaba18e-121c-4df3-ad5b-4f80713ce0f8", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766651588, "uuid": "d2e915a8-3c7f-4577-b93c-d0f2bf1433e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651588, "uuid": "1deea015-e21b-4024-9a17-a5bff5573000", "value": "VertexGuardianPro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8c52b8-e1c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766688029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688029, "uuid": "66db0226-57e4-4dac-81f2-cb1b4cb9b79a", "comment": "Malware payload (Mirai)", "value": "38f97ab42a9a1a09b7ee50f99925abf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688029, "uuid": "9b285b5a-3b76-4179-b834-c43c9c954fea", "comment": "Malware payload (Mirai)", "value": "a1e1b863adfa5ad714301cfa23d51a87cee8525da05514e03ab581f361f1be62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688029, "uuid": "b910dd8b-61e3-4675-b1e7-823141cf17db", "comment": "Malware payload (Mirai)", "value": "730cd5a9c98f95eedc73fb84ba6b6560fb44b79f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688029, "uuid": "90eb33ed-df74-4aa3-bfc8-b700889fde51", "comment": "Malware payload (Mirai)", "value": "c8ef42ff533423e4c48becaf6198a274dff546092e95f7f16fd9680702570836b0fcfa934e25f49249f15b76f49c5eac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688029, "uuid": "0d46d819-08d9-4c96-85d4-abdb1b66fb8d", "value": "T1CFC3D609BF651FFBEC6FCD374AE81705258C641A21A97B757934D828F24B24B0AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688029, "uuid": "4cc72237-759d-4da8-bf74-98f014043d01", "value": "1536:Z24T5Fajz9SdSQekodJdczca/rbowEjYv2rm6qaK1VDjZUhO1s0s81y:TT5FajzsAkodJfarbJZ1Bju8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688029, "uuid": "02d5ffee-5933-4a7b-b242-aa57848a6b83", "value": 125864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688029, "uuid": "ddea8545-6489-4c6e-a9f5-acd7c7265bf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688029, "uuid": "1b0c3dea-2681-4f7a-8db0-2e7a4d452511", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e24332a-e15d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766645077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645077, "uuid": "8e742cd2-fb24-4e04-866d-b5c07a242cb3", "comment": "Malware payload (Mirai)", "value": "9b24664e0afa4981a2f76d6569d7b80f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645077, "uuid": "a4f43677-c9f6-4ecd-93ed-28491ee47c18", "comment": "Malware payload (Mirai)", "value": "a219f8cefbbdc1be4ce1847b14cf068de8b44c8843005a3eeacba5433c1a4013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645077, "uuid": "6eeea7f1-7258-480c-9e5d-8ba21d449c7d", "comment": "Malware payload (Mirai)", "value": "2c7c296d1d0627b0b2aeda989df3c97756e202d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645077, "uuid": "9779dc41-ee9e-44e0-bcdf-f8d37f575f25", "comment": "Malware payload (Mirai)", "value": "6ea06f91a31fa90f227b3b7dc77a21e787390fb5a50d5da42a2902927e6860f938fa68e2c8fdb7016eb409f08d246b62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645077, "uuid": "4594d8cb-3e7a-4d7d-a1e1-1faacb27e3b6", "value": "T1B5A30856BC818A12C5D413BAFE1E118E331357BCE2EE7222DD105F24778A96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645077, "uuid": "070e0890-434b-4e0a-a1aa-c8bc7bbb0917", "value": "3072:rx0upI2vqIRDTczK5yHNYXDZVvDYadjKdauou:rxF7v9JTczKctYTZ5kaMbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645077, "uuid": "9a4fc3c5-9269-402f-9aed-9dbb4c8b3ce2", "value": 103732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645077, "uuid": "e0da463e-77c7-48d8-80fb-aa22e3279eb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645077, "uuid": "091b3068-d12c-4885-8e9c-f045ae5e1f87", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee55f0f9-e189-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766664297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664297, "uuid": "05ef3af6-0cf6-4712-84dd-74979a7b03f3", "comment": "Malware payload (AdaptixC2)", "value": "05742241859eb55ff0ad69e2aedd8277", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664297, "uuid": "610dc0b3-f79f-4ad7-8d6d-6bff5d53aee9", "comment": "Malware payload (AdaptixC2)", "value": "a29916e76ae4fd981fcdc130eade83e8865bdc6a8d5cc15ef3a8cff42b2a0af1", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664297, "uuid": "85b3d844-1980-4ce6-83b0-aa4711697346", "comment": "Malware payload (AdaptixC2)", "value": "da7861286c803f7e3b1a13ab4b069e1bb5f36c9e", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664297, "uuid": "13063afd-01f0-4b3f-ae33-01741103ab21", "comment": "Malware payload (AdaptixC2)", "value": "e90ee28cdc1506a6411fa662a5490e1cc34028e8c2dddf4ec98b84d4623468153a99ff73a8be6f76f29fe60fa2195bc1", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664297, "uuid": "5670e14d-bfde-4965-afd3-fc8844c34e6d", "value": "T12E7479F50B0F62C5F03A4D3C47F19440725B67E6F758988BADCD98DA3A316E213896CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664297, "uuid": "5e1901a1-303d-4ab6-bf51-5b172304a616", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664297, "uuid": "fe234f92-afd8-44e2-80d4-1306f4a21914", "value": "6144:zJmZZazvuXzV6SrvKy7oRUG4jXCiHyR0oSLx:zJmHtXzjrvan4zz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664297, "uuid": "1a108515-c16b-46d2-ab60-053b15900e5c", "value": 370741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664297, "uuid": "4d725c19-58bd-4fc0-a1c8-a3c9e02f58d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664297, "uuid": "8aaa7f16-5b56-457f-b0d1-c33f7a22cb15", "value": "05742241859eb55ff0ad69e2aedd8277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2de3e3e-e193-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766668492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668492, "uuid": "cc8e49db-71c9-400f-b18c-df65db17d68a", "comment": "Malware payload (Mirai)", "value": "7b86819c13a9e20a887e2ec9cd6ff079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668492, "uuid": "73fe7ffb-2cfe-440f-9133-115f033368b1", "comment": "Malware payload (Mirai)", "value": "a2cad6c423094fc2893f7a64a2cd1a62644b17644518ffd9d27d8d7d3d28065f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668492, "uuid": "845b09dc-6f70-46fb-8cdc-ef978ecbb490", "comment": "Malware payload (Mirai)", "value": "ae58e5a29091f8acd2a1ef54c9f47b8962d4d83d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766668492, "uuid": "5ccea3cc-0883-478d-9b2f-5466d8093bc4", "comment": "Malware payload (Mirai)", "value": "01148cf6177995dd033a16ca06afd06face0fddd120c7b32a763f3426f760c305d9711a611405c839485b3df7654edb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668492, "uuid": "fb10a42e-8a9e-4f25-a06d-fabb2bb60d5f", "value": "T119631951BC928A6AC6D063BAFA6E658D332173E8D2DF3257CC104B157B8591F0E73B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668492, "uuid": "ba5c5fa6-19a1-4c08-9d17-e64b29bf1b8c", "value": "1536:Z6bDXG0f9NOUO6MJ5DAlwMkyd4N60C9Juyc8AObxIaF8ytM4w:8HXZf9N7O6M0lwPyc83lO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766668492, "uuid": "07074dae-ca94-4907-9e6c-696a8bcb1a7e", "value": 68324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766668492, "uuid": "9056b7eb-0db1-4298-be30-b5fb113a7a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766668492, "uuid": "dd688499-021e-411f-add9-c2b3b83d5542", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bda0bb-e1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766705489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705489, "uuid": "d5caedf7-9566-44fa-bb14-9e668025665c", "comment": "Malware payload (Mirai)", "value": "cb734870c069e105619beec3e88bdabe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705489, "uuid": "78740a25-4c8b-4e0e-a2f3-0ebb90b9f849", "comment": "Malware payload (Mirai)", "value": "a4cfa37f00adfa76d1a57267fb6ac37933e3a37950eb5380ec3c5cb3669e84a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705489, "uuid": "7785e1e4-881f-4835-9599-051de16589ed", "comment": "Malware payload (Mirai)", "value": "3589d6f93fb309ae2b0636fec19b8fa7c92b713b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705489, "uuid": "5911b544-d1ca-45e8-b88e-361aeb07ed4b", "comment": "Malware payload (Mirai)", "value": "7edec2cc1b0c95a244fdca5556927b16d44b4c2e8b817cfdaab80aeaf170c5b67e96f74c0a281cb277a3f68b9d7a4119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705489, "uuid": "d54d5d55-d639-461c-94a2-12bd505ce537", "value": "T1DBA3C71A6E559F7DF76C823687F78E20A75833D236F0C645E26CE9005E6034D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705489, "uuid": "f29b2860-9101-46c2-bc2d-fdf2eaeef067", "value": "3072:ZWH+HhF3u/nfcMlynwWKaijUgKDROLT2W:ZC+Hn+InwFjUg2wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705489, "uuid": "f351ea9a-3106-429a-95b6-0f3ae8ab5a72", "value": 105484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705489, "uuid": "563563ce-a6e9-4683-8bc0-c24c16512e8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705489, "uuid": "d7c92ade-d1f6-4492-844e-353a6b3c50cf", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c2bd67-e12d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624420, "uuid": "967fe811-c4b9-4e2e-a538-acd21ba90950", "comment": "Malware payload (Mirai)", "value": "c3caf667ba0692e17b497d957669efb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624420, "uuid": "ce3074db-5a3e-4470-8852-e46a2e6c0927", "comment": "Malware payload (Mirai)", "value": "a630030011fb60df309dacf77666b81d83d3f8ab0d4556cb5810c9678fd27c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624420, "uuid": "325631c8-e45d-4158-891c-287dd295720c", "comment": "Malware payload (Mirai)", "value": "362a89da2df7b1c1f317700e37f101be2dae5af0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624420, "uuid": "9749b795-5d1b-4c69-9007-96dd562c010d", "comment": "Malware payload (Mirai)", "value": "f81a4e2dafafc11fa91cd8ba87957011a3a2f2e2ef113d70d2eedf1c7f99fced5e063f53b251c4c727402bb146c643ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624420, "uuid": "815c14b2-012e-4864-867e-31ab7f6f8aad", "value": "T1C863AE36C8BA6DA4C41886B0F870CF746753740196CB2FBB599989B18003E9CFA5D7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624420, "uuid": "65022164-c5fb-4603-86ac-9b95b6bd3866", "value": "1536:SafSJb5qw1gj1O7OQe83j6OAUOKSHHCW68BhYT6:Sh5tew7Ok5OKSHHrZzYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624420, "uuid": "41fc5478-b738-4c7d-90f0-699a765e19c1", "value": 66748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624420, "uuid": "c08d9c19-0c3e-47f1-927c-6d5ab0c5151a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624420, "uuid": "ee381617-8e26-4211-947a-f348243d75cb", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18860e6c-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672958, "uuid": "c5ef075e-16b4-460f-8b1d-104949e0708d", "comment": "Malware payload", "value": "0fff069f284070249e11af598df93e16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672958, "uuid": "d4cb74f2-d83a-4cb3-baa8-22c6f7ffd46b", "comment": "Malware payload", "value": "a63fb214c082ad7ed4db88b18ced9200e31c07945e63368245ab65a6cceea57e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672958, "uuid": "120b09b6-cd6a-4014-83b6-416a6c3ba1ed", "comment": "Malware payload", "value": "3cd97e081f53a7b65769eeb29df398dd3ad1d61c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672958, "uuid": "c49dae4f-a016-4de5-9325-be28146e526a", "comment": "Malware payload", "value": "2d17d9e17982e634058b274a0c639978699b2f4aca01c7b143d78269d81d72ace92454253dc7f1e9fdd7aac3c85c43f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672958, "uuid": "95fe3773-79a1-4f83-845d-26e35e385f53", "value": "T1E813B8CC3FC7B06493512063192FA09AFA1E4C44768C44A1E76759E4F96C728FB7AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672958, "uuid": "33b777c6-baa7-4357-9a68-484db7b815bd", "value": "768:4iuG+ux2GP550h74gBoG+na3vVX6rx987KsxzU4W59PcsEwnQ7fxRBL:4iu1Zo0h74gGAR6rx9xsBJW8AQNRBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672958, "uuid": "1a2d577c-58dc-4b58-a3eb-bd36f56820d1", "value": 43006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672958, "uuid": "f5090bb7-8ec8-41bd-97ad-10d8cc9026a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672958, "uuid": "f020fbc7-6287-465a-baf3-448685cc52e8", "value": "A89471 Jian rui \u4f73\u745e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f42239a-e14b-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1766637348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766637348, "uuid": "db280629-985e-4911-9bdc-23d8063c72c9", "comment": "Malware payload (NetSupport)", "value": "4a0027158e7999a72c6a4563613c1d5f", "object_relation": "md5", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766637348, "uuid": "733c36b5-5bb3-4e7e-a6c9-8c4db1507a48", "comment": "Malware payload (NetSupport)", "value": "a6c0894f388282d55462bbfc84a9ff1b17fb46e010d8cda0c7b66e3c680a5fd3", "object_relation": "sha256", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766637348, "uuid": "c32b9462-ba4e-46c5-bc62-2aaa23b8905e", "comment": "Malware payload (NetSupport)", "value": "f753c7cd52989b1867798469e702415d0e273564", "object_relation": "sha1", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766637348, "uuid": "e58b038f-bec4-487d-b3af-e87e239916c7", "comment": "Malware payload (NetSupport)", "value": "99371d2d7164f062cb5600f56c735c8c95c1c54c1c002f32b4e9c4fa13dd563ad76a082c5630958616149703d64b88af", "object_relation": "sha3-384", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766637348, "uuid": "961b72d6-f31f-40e4-b98e-9bfb2755addb", "value": "T1F7A68C788B849B5EAE6F1907E078571E77F37F66D09271FC4662270726AFD082239C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766637348, "uuid": "96bb42c7-8c15-4cec-88a5-05cfdd46e259", "value": "49152:gO6V9Jgq6k6BbV8LXTKKuaRcw66Q7b0AIbsacMyZ8dzNSeGeBvxZ:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766637348, "uuid": "59235a03-b9b7-428e-8cfb-6942ac31158b", "value": 9520350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766637348, "uuid": "6f60dc52-7323-4cd3-889e-c82decd65fe1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766637348, "uuid": "4451a248-761d-4744-bf14-affd8e28aa82", "value": "77.90.60.32.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ff0a39-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641494, "uuid": "f0dc86e9-022e-4ad2-8bf6-c9cfc7b84d48", "comment": "Malware payload (Mirai)", "value": "aac411d14cc72705f096ffd091b3b268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641494, "uuid": "ff037241-846d-49b4-beaa-0f4b5e951e27", "comment": "Malware payload (Mirai)", "value": "a77e4bb675686cdf72dd2b58952fd0f2393bf72f90b92b53d4155d044d3b86d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641494, "uuid": "0891d3ce-32f3-4d2a-8c3c-06c0714ff71a", "comment": "Malware payload (Mirai)", "value": "a2ddc027de35f28af2a7d4179f65d83b9a97a5d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641494, "uuid": "e739ede3-a5a3-44c5-a7d7-af11c1f4aacf", "comment": "Malware payload (Mirai)", "value": "5f19f9a6cb4c84540137cc260d6c9e3ad8565fa1b5017085b3e7cf8ab1cbbd62627a0cb5771f2b736b6e261b7f1a28a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641494, "uuid": "c5145ed0-7b6a-4ee2-85e8-7e08f0c2727b", "value": "T1BB930996B8918B21C6D452BEFE1E118D331357BCE2EFB2139D146B25778B42B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641494, "uuid": "4007f577-7ba1-4d1c-aba9-dd3dd7c20c59", "value": "1536:CpngNDzdjQ0GVh5O+Qvk5l2BqsDhHI1yi4G7tK4A+Zw3hMEi7MAmuLHAp7wPYnTw:J3u/2As+yi4G7tKtWMAmuLHApEP0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641494, "uuid": "d95032a1-79bb-4270-a163-c189640c6e48", "value": 89016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641494, "uuid": "7e817f51-3e70-4708-8fc8-3643fd3e65cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641494, "uuid": "510a5c2e-0f9d-469a-83b1-7b4c0d9cc6a8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb3c8c9-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666225, "uuid": "f4215bad-1382-4174-ab50-c21f28c33381", "comment": "Malware payload", "value": "6759b38e03b68f8e110b6f462781ba90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666225, "uuid": "d67a5f59-5d11-49b3-b0eb-b5983ebdd015", "comment": "Malware payload", "value": "a7997eae87ab1d0312f9b2099292ab7eec71803887b5ed388371b634d6154f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666225, "uuid": "d80b95ba-5123-4371-914d-f3d4e33dc979", "comment": "Malware payload", "value": "8a2837a35fe5a4adc8b17103739f200e09b923ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666225, "uuid": "7cfd989e-0f1e-4ff2-8b41-08fce9cd11f6", "comment": "Malware payload", "value": "36dabc977805ddb48d10bcabd034ca7e49e6485347bcb5fc54e6eef5a8ff6785c71905490dfa31143d5058bdff376bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666225, "uuid": "c010258d-86e9-47cd-8b22-79d226d94c3b", "value": "T159247D21B4C1C431D577153309F8DFBA5B3DB9211B626ADB67980F7E8F201C2AB3196A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666225, "uuid": "ccc184e4-6bd2-4a4d-9be0-561889ca8d3d", "value": "31ba2dcb49ab5d61acfa8dae6ea3c66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666225, "uuid": "9aa72437-6e31-4306-9d2a-f46cecce52b0", "value": "3072:p9VXUi/M2MjjGnzOy8YU9PIQjGg+nHWulKJAvnZGnp0nGunADb8Hvgvp3mjxM87D:2qSYU9gQVK/GAvnYnOUooIjED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666225, "uuid": "90424028-0e82-43a7-a037-ba979535828f", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666225, "uuid": "e1ae0fe8-3e22-42da-995a-364288016d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666225, "uuid": "26c7b6f7-e7f4-4979-b039-8b43ceb571f2", "value": "6759b38e03b68f8e110b6f462781ba90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c23f905-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666602, "uuid": "dbd65f64-d00f-4d2d-acba-20f582428e83", "comment": "Malware payload", "value": "60bb86e34c84d694a2420802981cbf9d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666602, "uuid": "67f2a625-d20b-4454-adae-d3ae67cea0ff", "comment": "Malware payload", "value": "a7b64c603b4a2d6fc147c3b946bace6d13dc43503fe19f84786e0fd08b9ea3d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666602, "uuid": "58474e8e-9077-4b84-88e8-4cd3044a533d", "comment": "Malware payload", "value": "c69a4a3d4f55d63d9dd5d45e72a830b27ce2c1c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666602, "uuid": "d78642eb-0db2-48e5-8372-59247f331a23", "comment": "Malware payload", "value": "82487661c15a762c508d17f7a43c14d35fa45615d4eee208ab3b93c7c6c3f71cf969d4672da72dd2acddd17ff89d62c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666602, "uuid": "80f9353e-9742-4950-a086-f454d1a79811", "value": "T168D43BEC31ADB6265EE342F5106F1507B2782823580C8860F121EDBD37B999951BBFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666602, "uuid": "ce65da60-e1e6-4bb9-98dd-ff2f823554d6", "value": "6144:T69o4f0ENXYofTwiZ+N30pzozzGql4erLnQEsDFx6FuPuuNp1m8LcgigN2kI/:mZfxNXw930pzoZlzo7IFudN+9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666602, "uuid": "3cbdd59b-a6e4-49a0-83a7-da352c10a46a", "value": 612349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666602, "uuid": "2ad10a6f-94d5-49ff-bbe9-bed17dd845f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666602, "uuid": "be408b1a-0af4-43db-baad-befa13541a1f", "value": "api-dom.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0106afe2-e1b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766683656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766683656, "uuid": "cb3e341b-6394-4894-a176-9381b417bdb4", "comment": "Malware payload (Mirai)", "value": "f346f841187d612a01d298ff9a479b02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766683656, "uuid": "f4ce4f48-5bb0-4590-a96b-e92344dbc4e2", "comment": "Malware payload (Mirai)", "value": "a855721cb3d14f941717af95f8e83bb1d9b30f039b77088fd83f0d8bb39e88ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766683656, "uuid": "f21762a8-c691-4faa-a8a3-7c435850afd1", "comment": "Malware payload (Mirai)", "value": "c9c87841542431776a123c29eb1f6814525b2cbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766683656, "uuid": "678cf915-76da-4645-a1f4-e7ec86403dae", "comment": "Malware payload (Mirai)", "value": "e98390eb0e12506fab893b7acd93f3781823425f1d7788b22a6a4688058ba1af6aa592d1c7b90abea136a91e90e736f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766683656, "uuid": "ad69c3be-79f8-459c-b203-a2fd6270a845", "value": "T19783AF33C42E6D94D0589538B5A58F390763E40186236FFA5AE5C7B69087EECF61A3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766683656, "uuid": "b8b64ec9-4015-44ab-8169-48f475fde34a", "value": "1536:O/+DL/pqaWiv3Awt/WFkXY0sQiQdjY6QS7iKkHe1qag3CFKC:OmfosYAWX0vtH7FkHag3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766683656, "uuid": "1ead9cfa-cb3c-408a-b1ba-9c3b6a9420ad", "value": 87408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766683656, "uuid": "7660f0b0-878e-46f3-9052-988db1766207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766683656, "uuid": "b951a44a-cf8c-4e6c-965d-96b7339b9a72", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23efba8b-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700894, "uuid": "8f16625d-3193-4e78-8cc8-02b9a2ec6018", "comment": "Malware payload (Mirai)", "value": "894320ab2220e1c13456320290337c44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700894, "uuid": "6d72bc46-7920-4d4b-a663-2a74066a2005", "comment": "Malware payload (Mirai)", "value": "a9aa8f6da13842a7f773c229c89005b1f667f2211bdfe9519fc6b9bd36f0872c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700894, "uuid": "2ef76d9a-c984-43f3-bf83-2e224942f2f7", "comment": "Malware payload (Mirai)", "value": "ef9f152d35fc4121d11d4f9d67e94461eabba4f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700894, "uuid": "02e5eaa9-890d-452f-9192-32f604c8fd77", "comment": "Malware payload (Mirai)", "value": "1a9f86f8e3981060dab2a4c2f074099789453170be261799598eee2ef1b471ff01c140f9f5ab6c552afeaae2597805c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700894, "uuid": "f16acd30-0682-427c-85eb-6f8e25d5719d", "value": "T13DD31851BC829626C5E623BBFA6E018D332667E4D3DE32178D215F217B8690F0E77B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700894, "uuid": "9c883d07-5559-4ab0-953b-9352f1d49256", "value": "1536:DKPv7vzV3iZEnfKYzeLVmikmZZfRBoOdTIGSb7+vKLPlpn9yrTJwzp+znFNORb:DKPvHVxS3Bob7T5t9yKl+pAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700894, "uuid": "648c81b3-5242-43a5-a4a6-2c87bb22e968", "value": 132552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700894, "uuid": "856fbc05-dedc-4c26-979d-f944b75ddf5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700894, "uuid": "3df29a02-c95a-48a0-a2f0-1a3aadcde015", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f756c9a-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766690337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690337, "uuid": "6b9a6fa3-534c-4e41-8a55-1f75d40107ab", "comment": "Malware payload", "value": "6c8e6c9fa700c8000a26137fa5ea6502", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690337, "uuid": "c5355cb6-3abb-4b38-9e3a-1fe2a3f24721", "comment": "Malware payload", "value": "aa3803a34237fabfd445dd8a7ed0853168f2bdce7289e38b0fc3f1260d2e3cf4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690337, "uuid": "c1b4d095-f39d-41b5-8849-e4240cd7158a", "comment": "Malware payload", "value": "0e8750cb794920fb4a3b37dd8dd2de171ec293b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690337, "uuid": "46ced193-1134-4216-abf9-42e7294c5767", "comment": "Malware payload", "value": "d1641126d403e1c7d1507b8253489930bfa8755678e175a0f795918c85fe1b53da12c5113d5ae26c74ecac988945054c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690337, "uuid": "15932fde-6a7e-47a8-b256-2c10fc71f6ec", "value": "T1181151BF28111E7B8D0A8D9DD52784B064D399C07E031D516B1768B8CCEF228BB659E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690337, "uuid": "2022727a-5c5b-4606-b820-1240e057be11", "value": "12:ovzs6gzVbkObG+Nn/5Zxn7LKQzOOjbin+VVnmSv3Dt2OzlByPcHv:5lG0PPKQy6i+LmATtZgPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690337, "uuid": "42a01147-b66a-4a28-903f-ecc4e0dcb6df", "value": 945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690337, "uuid": "fbadb16e-3c23-4d19-b5c6-c65e6e2eae5f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690337, "uuid": "82cad0d0-5775-42d5-847a-25acba57738a", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffde9fd4-e1c3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689237, "uuid": "d98a06d9-28ab-4027-ab6e-2a8ba54cee9c", "comment": "Malware payload (Mirai)", "value": "d9c989041d10869c62bbfcd12e5a5260", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689237, "uuid": "e3f67c39-33ab-4503-82cb-3bb568b78500", "comment": "Malware payload (Mirai)", "value": "aa5d8308090c57e68c9a1d78563a7b6c7fe42cc155b49f99ea809718c9c15cab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689237, "uuid": "ce64fb77-eb4a-4c20-a49a-acb57ce04e61", "comment": "Malware payload (Mirai)", "value": "6690302fedffa607a78c95862b63e3492be3f00e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689237, "uuid": "d75f4162-429a-453d-866b-537ef8fd95ec", "comment": "Malware payload (Mirai)", "value": "767edc364492d4135ac0f8081363aa0aa76ef4333fd1ad5cd976db881b9f9a8d3062224edfd8b61aac556405f2d974f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689237, "uuid": "2f33751c-4141-4b61-8b45-1bff63c4017e", "value": "T1C5533BC86903DAB4EC155131E47AFB3A47BBF53F0029EE8FC7948562D4A3952A6123DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689237, "uuid": "f712900f-0b53-454c-8e62-333a5afa8860", "value": "1536:8bL12abzth+V7h49Xc5uYaAyKN/uBv+lsPCHsNEvdr3myhc/CrQldE:8bL12abzth+V7h49Xc5z/uBv+lsqHsNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689237, "uuid": "4d89fc3e-880a-490d-8039-f5799315c7f8", "value": 62340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689237, "uuid": "217f22fd-246f-441d-a35c-e56d51ac87c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689237, "uuid": "7f36050d-95f8-4c96-b55e-d08c2a5be5e5", "value": "shadow.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8b6f45-e178-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766656699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656699, "uuid": "c6e2b3cc-e433-4cbf-827d-d678f8728c6c", "comment": "Malware payload", "value": "c568715abe6061536410a771cadc3123", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656699, "uuid": "71cd0480-c905-49ed-aa11-8c2c649a4359", "comment": "Malware payload", "value": "aa7c4b33173492ca9432b6552c86c44a307e7b0c765407380c1c655eb37d26f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656699, "uuid": "56ead2cc-1258-494c-86af-67ba89998fb7", "comment": "Malware payload", "value": "30fd16a0f55746658d37809d8de7eeab5fa0570f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656699, "uuid": "79438a95-987e-42f2-a75c-94046d0bd259", "comment": "Malware payload", "value": "d9dd8edbebd404dfc5c356a51d897951930895e0d3e7382bf9ca4032e59588dcc80c18236ec289e217d74a9b4afd2431", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656699, "uuid": "6633961c-c47b-4b27-acb7-42aa4658bee3", "value": "T14E11ACE821D0981B59EACC0C72E9801CA63BD0C579618B34ED79443744E72B86F6C7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656699, "uuid": "efbc6721-58ad-4fe1-b159-140f209145a3", "value": "12:3J3+Aw3XzuNIBS+5zoKSr50xHXf7M8x0l9AXQI9ovSTxy2aF6YShyrQbk:3J3+RCNIItKSrU3g8il9AR9tKWOQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766656699, "uuid": "144b68b3-5627-47a3-a4a7-aea4d740e9ab", "value": 892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766656699, "uuid": "5d6f768c-19c0-48ab-9d75-c9ed525c57ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656699, "uuid": "d342e0b8-f43e-4792-ba0f-dee707b8aac1", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae977c6-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672962, "uuid": "63350483-d5e6-4321-b173-e2d3dd2bc761", "comment": "Malware payload", "value": "ea4e3b18ef5ce564b7eac21d9e16e0ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672962, "uuid": "d5a15793-696f-4335-ab2e-3bcd45cf7df1", "comment": "Malware payload", "value": "aa8f3f9ab527e162ddd3dd446316c3adb096fedc2ada0381a8a0fb78103f526a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672962, "uuid": "1235b2c0-9194-4abd-95de-ad0f9951f542", "comment": "Malware payload", "value": "dd098f4888d052c687de6b80aaff7ff1268b2ab7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672962, "uuid": "f57d0b9e-c24c-40fb-807e-3fd80c143418", "comment": "Malware payload", "value": "39fba662f46a88ac0bc8d4460760b2dba56ad95fae2251c916234e7106ee37ed7661606713e2abf667fcc665fa06d5c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672962, "uuid": "0fd154c6-de6b-433a-ac03-fd9a861da45d", "value": "T1BF13B8CC3FC7B06493512063192FA09AFA1E4C44768C44A1E76759E4F96C728FB7AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672962, "uuid": "2ef32a87-4210-46f9-8e4d-39aad1d8e56d", "value": "768:4iuG+ux2GP550h74gBRG+na3vVX6rx987KsxzU4W59PcsEwnQ7fxRBL:4iu1Zo0h74glAR6rx9xsBJW8AQNRBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672962, "uuid": "3242d0b0-2b50-481a-ac33-92af0e53bd4f", "value": 43006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672962, "uuid": "083d37d7-841a-4b96-aca8-b017eea4863e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672962, "uuid": "a58afce7-6c96-4fdc-9ba8-d1cd1e7eb21d", "value": "NEW PO 67088.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc501f1-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690869, "uuid": "89aa0d8a-daeb-4b34-80c3-ff4776926814", "comment": "Malware payload (Mirai)", "value": "626bc506747060dacd84193b87a308d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690869, "uuid": "d157286d-c7fe-4ff2-a724-790a4eefe59c", "comment": "Malware payload (Mirai)", "value": "aab8256ac936aea9cf98f33be09fdae6556b5f7d57ab3a3d6de8f36723259e0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690869, "uuid": "ec7a1ebf-a829-4b88-b1bc-c68eda74fc87", "comment": "Malware payload (Mirai)", "value": "f7a5518cd3421f22c01926431e0695378579e4e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690869, "uuid": "ab4856a9-36cc-45fc-aed8-e9055798e1a0", "comment": "Malware payload (Mirai)", "value": "22d8143c8653d1a1d867b44151b8d93c2336da10c313560f3b82652e4b4591663ea3f0e8b060cacc944ae5db11ac1446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690869, "uuid": "cbdb4de9-c170-4ee6-a57d-6f7b9d8d861e", "value": "T1C821CE96A7E36D67CD941637DDAF5B10F322BE48869EF503E31202261C3F20A1F21089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690869, "uuid": "3993d5a5-3918-45c3-86bd-13eda9eefe69", "value": "24:JKR4llMRgP9qD0at6EoKGi9rUlFSy4LzLCkIddgERGIUX3hVNfW:JKqTFqDPtL9rkFSy4LzL5IUX3hVNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690869, "uuid": "8cbb1fff-e98d-4384-a699-89083a3e7a6e", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690869, "uuid": "e087a948-5183-4d2f-8252-eaca2c606005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690869, "uuid": "fc3504fd-2589-40ee-b936-1f458de5d16a", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca5b708-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766672991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672991, "uuid": "a8d913cd-2b59-4823-9b6d-5fe44f18f136", "comment": "Malware payload (Formbook)", "value": "8b74bdc4e8d9dc5ecf4ecf6feb239058", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672991, "uuid": "540ad34c-1011-4a2e-bdf3-453cfef6476a", "comment": "Malware payload (Formbook)", "value": "ab8f034b89a3f3f3c7a77d3e5824fd4e4deb9734aa650cc78b0c3001e93a2a48", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672991, "uuid": "374ac83b-aa04-46c2-b96c-37260e353a18", "comment": "Malware payload (Formbook)", "value": "353a620b9333a460bfdf7ca91fe45b4ea9d8d21e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672991, "uuid": "5060c482-e8fe-49d4-a33a-36495a02cc21", "comment": "Malware payload (Formbook)", "value": "9351c27b77aa25183027ff52a6d03d9d6cbe31237dfbfc4c81fcff3ec1f042e4facba38cca66fecc770a5e0ededad7e9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672991, "uuid": "80cf5c05-5348-4367-b01b-6271ca6df63c", "value": "T17D26DBA2678E498189E07F131EB1B82FFD54D09E70BAD3387632A2C447291E1CB67757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672991, "uuid": "998cab0a-1edf-40b4-bb2f-a01dc02dff8e", "value": "192:U+TcvmxpZTNnUoRALvNZu3vjFK0Ab8ErAuR:gW5zErAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672991, "uuid": "42be821c-01db-409a-961f-561bd5a1a168", "value": 4623778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672991, "uuid": "58ff19f7-651c-4a29-99ce-0afc2960687d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672991, "uuid": "f73d9e5b-034d-40bb-b716-75274615b9d7", "value": "SOA-12232025.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1d7441-e19d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672912, "uuid": "e0ea95c3-799f-45c0-8095-094c8fe4327f", "comment": "Malware payload", "value": "1cfa241e35938ca08e36be0e4eb36f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672912, "uuid": "c792a652-c6d6-44fe-b6fe-2e771ddba1bc", "comment": "Malware payload", "value": "aca9a73f9be8791b0f672a93b15f27c09b0944b39a8a8b2d55d7153f9ad887d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672912, "uuid": "99c7b226-554e-423c-a910-333a8a5d8a4a", "comment": "Malware payload", "value": "b53cb4b83e3134a27dd257a36d6baf0391c2d0c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672912, "uuid": "521e2374-b4c8-4729-bf49-a2299de7106a", "comment": "Malware payload", "value": "1e1fa66b784315edd4c451c2ef9eeb951c7dd55badb769cd2b8e7e3b9254f9c50a1f3fded8f0e65b5ae4b6ca2f9c1711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672912, "uuid": "bb5d82f8-0523-4b84-8cee-c6fb04a58677", "value": "T1D9A7BE26B50CD8A9F6760AB1D91275AD48773FF06B135883FD9036AF1B37690E9381C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672912, "uuid": "25d0d6c6-5676-482a-a88d-5137ebdeb3b5", "value": "d7e432b31a2364cbf33d4eb1b92d3b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672912, "uuid": "5298ee76-387c-4020-a4b3-521c5edf357d", "value": "786432:6+hRxqqtrUe12BFHuoq7lQUUuzYqGt3E6ffqazm:6+hRrrKpuoq2g/G1EAqim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672912, "uuid": "fc2285c2-fd26-4244-9a60-7b664e34a554", "value": 44701575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672912, "uuid": "a73920c7-b202-41f4-8b42-1e5d78b5c2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672912, "uuid": "6bac57c8-ef33-41d9-bd79-f48e5dd375f4", "value": "SecuriteInfo.com.Trojan.Win32.VMProtect.31303.11235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b27afd-e1c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766687858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687858, "uuid": "eb1dba7f-0fb8-4e63-bef7-b86a9e2acf04", "comment": "Malware payload (Mirai)", "value": "d0e8fb1632936ed33a92053d9531628d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687858, "uuid": "85630a2e-1144-4a44-961e-17a6b8701d34", "comment": "Malware payload (Mirai)", "value": "ad3870bec73f2e3524a565e58cc2876924a7cea1beec7f5397afe1ff053d3bf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687858, "uuid": "d5f51ee1-04c7-4c5b-bb2b-adcc3d614fa7", "comment": "Malware payload (Mirai)", "value": "654ea20c1fcea2cbec51f4f83f729bce84fa13c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687858, "uuid": "b90cec32-d4ee-47a5-9fbd-f00ef437befa", "comment": "Malware payload (Mirai)", "value": "fbd2ae68a34c5685970ff8fbf89614c1580c81e8ba254eaa759f60201a24160df23c01db8ad8101b566fcfa2e62aea60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687858, "uuid": "9bd6fd4c-a30d-4970-88f2-fd7eca73378e", "value": "T1FC632851BC928A6AC6D063BAFA6E558D332173E9C2DF3217CC105B157B8991F0E73B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687858, "uuid": "bd755bef-63dd-42b9-8e43-a5d5dff654e7", "value": "1536:rw/qld09NdLp3V7L8xLXd1Je+OzOowk3acfCxIaF8ztMobB:rw/qlm9Nlp3VULXVMawE4O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766687858, "uuid": "532c4884-a247-4258-848a-28f665ae3ad2", "value": 68060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766687858, "uuid": "b39a1d90-9b85-478d-8c9f-51e411b14b56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687858, "uuid": "b4a23981-93ad-469f-88f1-53366be74eda", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535b0e64-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666184, "uuid": "c9b05f05-c1fb-4e32-abb5-07686439563a", "comment": "Malware payload", "value": "6ac6f5dc983d0f69c08c68be62964193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666184, "uuid": "8d5271cf-6a32-4652-a568-0b3f10a78c22", "comment": "Malware payload", "value": "ade2250e11f484491810cf2c6975ca728123c650c9306bc6987f5f4a378a01c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666184, "uuid": "14b34d7c-faad-4310-aa47-708e0e5089d3", "comment": "Malware payload", "value": "49d691a56b006684e24f16ead666cf0ad9d4ca06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666184, "uuid": "6cb236a7-9665-49ca-b742-a0d8405a52a8", "comment": "Malware payload", "value": "32ec8bd6cbecf19e5e91fcb92659e1acb818d00dc70ed4e6a4a8d7aab4ffee7e0bedd460964b7da1c157027ae233df20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666184, "uuid": "2214bccc-1967-43f2-9a66-17955edace50", "value": "T122538D13B7F2C032F16695B409249B624FBE782156B4D6BB1B8C10E9AFB1690CF35367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666184, "uuid": "1e4b43ca-4295-409a-8561-99726ffcada3", "value": "55380ca6450e841d3d090c9d1307b680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666184, "uuid": "c228daa0-4b86-4201-9677-2d3be89ba159", "value": "768:GUp9fff0yKZax2wNfEiMgQacRZidIZMq+sZhHxDPakkWLEDDNVntAiNwZCi3AhRE:df0yyaRlDsAqxpSknE/AAhoB2yk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666184, "uuid": "3d602e22-c31d-4d65-855b-509dcdae60bd", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666184, "uuid": "c69f7735-4790-4c6b-9609-93b257f3a3f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666184, "uuid": "c336a9f2-8cba-46b8-8fa4-4956aa20c0ac", "value": "6ac6f5dc983d0f69c08c68be62964193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51da7283-e1e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766703978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703978, "uuid": "6bc40c30-8a5e-496f-9397-c653b365ab9a", "comment": "Malware payload", "value": "6dca836112651dfb49de0f16fdee5e1a", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703978, "uuid": "4570d36d-24ba-4e48-8d36-0a3764aa1526", "comment": "Malware payload", "value": "aeb7528bace6ab26fb095bd84d4a8b5e1606c0ff8380eb451de8eab4aeb3871f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703978, "uuid": "663bbb42-3eda-41c2-a985-3fcea0c86593", "comment": "Malware payload", "value": "52ec9bf51ffafcf844f5ae96cfcbabad96728a61", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703978, "uuid": "b895517f-2ee9-41ce-97d2-6d5e92251a55", "comment": "Malware payload", "value": "07d03b3e7af6317d082eaacbfa4f3a84eb2caeae95e01d772d5343e1da5939a8de761fc89119a345d223704d230f5441", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703978, "uuid": "ddc1bb5e-adc6-48d6-9236-76bc4019f926", "value": "T19E083321B16B6964D21F53BFE0B8AFCC84313DE17317D5AB23787BB245B268261B1943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703978, "uuid": "e03ff02d-a130-49ef-be2c-deff70061311", "value": "1572864:Ul7SgYK7KnE9m9hBmdn5TSaxDZe3iEf3cT8uDESzccn8VeVJU:Ul7SNdE9mYHTSaxDY3jUEYb8Vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766703978, "uuid": "79c8968c-ea7b-4826-a4f7-97f22d3ff07e", "value": 79921664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766703978, "uuid": "89a029d9-1f9d-434f-a96e-80f3247697fd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703978, "uuid": "c47eeade-97e1-4982-a1ab-5da57fa5cd97", "value": "555555.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9011da37-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690338, "uuid": "6132159e-37e2-4b47-8b3e-2a58d046ebf2", "comment": "Malware payload (Mirai)", "value": "1fb4b632cb59507f74e03b1a730ccd39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690338, "uuid": "8bf176b1-b9c5-4a04-9982-d55e9fec845c", "comment": "Malware payload (Mirai)", "value": "aeda42b413fe50a381d97e1108aa336ee6be8489888b2c2db4ebeddbdd4392f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690338, "uuid": "24aa7fc7-28aa-4d2e-a86d-7e848c03ec9a", "comment": "Malware payload (Mirai)", "value": "c86726d6daeb5c25151887bb35caf291acdf4330", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690338, "uuid": "cc6509ff-b5f3-4472-9e49-cfd5457de1c8", "comment": "Malware payload (Mirai)", "value": "293d18e84c8e62f004a2ef484df409ac5efaf8734e00aebc0313a07324ea96de935d2b669957017997fa3d4890f932ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690338, "uuid": "e369e79f-9357-4d32-9115-0d0d1e5382d3", "value": "T18D1151CE31911FB75A089F0CF577802855C3A8D8FD626DD1A3161C384CDB72DB528AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690338, "uuid": "b46dc894-6326-4cd1-9d6a-cc94d19fa9b0", "value": "12:oZXWsJWWW3bGNWWWtMNWWW2u8NIl5ONWWWLa0LK3NWWW1tODOmNWWWjpiVNWWWZL:m0T8NI7pKfDsiz+WA3t7dUP27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690338, "uuid": "71f16d95-5648-4cde-81e5-4a2f6af64e63", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690338, "uuid": "e77e63ac-f970-4d46-990a-9ba37e28dde7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690338, "uuid": "47394b16-e661-42cc-a677-383e3ebe9f2f", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c858a665-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766641470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641470, "uuid": "13ab3cc1-184a-4217-8bec-174c6255b357", "comment": "Malware payload (RemcosRAT)", "value": "4b080b2ee7cb5757200b45e56341a40f", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641470, "uuid": "548f427b-34cf-4d92-9c8d-005278884c87", "comment": "Malware payload (RemcosRAT)", "value": "b07ab96a7ed364af35708f7547829378f10d747e76e479e5a2b607fd2e30602b", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641470, "uuid": "f6c84568-2164-4ff3-937f-c4ab290965da", "comment": "Malware payload (RemcosRAT)", "value": "2a56ce1fb37f15b76d369c13725189e9922cfba6", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641470, "uuid": "70b384b6-2f10-4d38-978f-d33bbb58588c", "comment": "Malware payload (RemcosRAT)", "value": "19eef4213f770fefaa938aaa21797e1366b521cd4eaf02d6aaf877302eee8ee0cae50afeba611c50710803a7a6d78cbf", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641470, "uuid": "2776c606-ec82-4d27-b963-2c8fa5c6c299", "value": "T1E00733AC0F727C6FEEB3815781692184E4E184C7543A19EC32A1979314D66E319FFEB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641470, "uuid": "a87323ea-7b3e-476d-8365-d5b5d1dc4d91", "value": "393216:0SaLA7+ykEZ0sawGZvXO3BUIPsK61PdmNwUL8hXN0zB3hN:0SaLA1kEZhAP6U/ZlPUQ70zBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641470, "uuid": "45025935-70ba-4b81-8fcb-147b91fa7ba9", "value": 17472686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641470, "uuid": "2c942127-3da4-4770-a65b-e65384105c19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641470, "uuid": "90a8a870-565a-4453-a56c-3cfc6e3c2e5e", "value": "b07ab96a7ed364af35708f7547829378f10d747e76e479e5a2b607fd2e30602b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd1d94d-e1d7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766697824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766697824, "uuid": "b74a4787-93f9-41b0-86da-ac2cce2b96af", "comment": "Malware payload", "value": "37b99fc7edecf05abc6f84f3b5cbd17d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766697824, "uuid": "1f042376-6eae-4ab2-9300-4c061fdcf198", "comment": "Malware payload", "value": "b0c25fadfb9727a68e1e7aae95c58a28a32e87ac9ad6252356ca6e7940c2112d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766697824, "uuid": "df5637ad-e646-421d-b820-ff63793ae9a1", "comment": "Malware payload", "value": "a175c6ca4d3ff8ccc72ccca1889c6e3917ced7ca", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766697824, "uuid": "8ee17335-c5bb-4b3a-a517-a75cea8e8b6d", "comment": "Malware payload", "value": "cc1681b92217107df96ce440f59ef5873ea3b94eecb69e486ff198106fc836828359dd80cb7ba2018a94b6e50bec0b7f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766697824, "uuid": "9be38ed3-d24b-414e-b6b7-5d94b60865ce", "value": "T194E0EB849C28705FEEDFC598872203066C4722C2960F83411B2CF8313A02EEEC7DE8A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766697824, "uuid": "c7282bbe-11c7-48c9-9cf9-1632c911c1e3", "value": "6:hHNGDXvay2olNHn+YWjvT9Ds81R3KupMFXA98WFW0LW62EIJR3Kb6:myyrXn+YWjvT9Y81kUMhA98WFWyW6mk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766697824, "uuid": "760ccaa4-cc01-4f74-99e0-0102cd098a13", "value": 307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766697824, "uuid": "1af86e59-ad3c-4643-9dd5-7f1ffdee8d41", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766697824, "uuid": "451d5cd9-0cde-424d-bf87-a178c69ec439", "value": "ghost_crypter.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa421e8-e15f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766645911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645911, "uuid": "d130251d-a0e7-4f2e-aaf5-cd163b7c127a", "comment": "Malware payload (Mirai)", "value": "3e043fbbfbdc9b572e0216450031c09e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645911, "uuid": "f5e2d16d-3aaa-4985-bf22-5e7c3cea99c8", "comment": "Malware payload (Mirai)", "value": "b350e1b4534a80d4ef79365debaac65d358680d6540aa2dd9306d59592ecf5ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645911, "uuid": "ff70c5d3-31e0-4beb-8acc-e2184faf467b", "comment": "Malware payload (Mirai)", "value": "bdf87dc51690550dffc0ae6fc9dfd2752a002db4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645911, "uuid": "70841ecf-bbf7-425b-a3cc-7d4f89467378", "comment": "Malware payload (Mirai)", "value": "c40c7eb8dcf904e8a41de125e0f39d8d423cf488d6dc569a192bb997cca45842cfe82cffd5d4b0e80d21bada12022060", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645911, "uuid": "8a491488-1b88-4275-8644-4cf1a516b921", "value": "T1E914F946BD518F23C6C311FBFB9E429C372667A8D6EB3102DD257FA437864DA093A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645911, "uuid": "85586692-22d9-4dba-86cd-81378db534b2", "value": "3072:Y3TlJxGMSsd8EsAiEmjRqTiJKzTp6c4JVQZsIhatd9jp7nGbWL:GDxwZETLmjkOJ8Toc4JVisNX9jiWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645911, "uuid": "cede9dc5-dd83-4c3c-894b-1bb566549e64", "value": 206172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645911, "uuid": "d8286971-9ce7-4f10-9407-9c44da886bc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645911, "uuid": "b9ccfa4a-4be0-49fc-8967-6999fe7bf0da", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e910f3e-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700885, "uuid": "d37b0af8-b6a1-4adb-933b-9312552de7d5", "comment": "Malware payload (Mirai)", "value": "ead256bd6db530b7aa78ea64a3d73643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700885, "uuid": "26bdf5d4-339a-42b7-9303-e6f8eba5786e", "comment": "Malware payload (Mirai)", "value": "b3adecc3f197545edf079d3dcedc3f32971aa2a83c916d5803b4d75fb5ffd594", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700885, "uuid": "144e84b3-1324-4c67-913b-e88ecf83ec96", "comment": "Malware payload (Mirai)", "value": "569242fac4948c02ddcaee3ca2e4087fd8129b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700885, "uuid": "068cc41a-377e-45cd-9075-ad23389df7fd", "comment": "Malware payload (Mirai)", "value": "268d078cefe0fd7a58c2f461b5317b5d2d321ab59f48bb5739a89a3ca0b0f981ab37eee207289bd48fe0a6607d5724f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700885, "uuid": "58e5c578-ff7e-4378-9677-0802ff0fe70f", "value": "T1F7B3BF35D46A69D4C0608474B8B0EE351B62F6C841472EBF2AE5C5B600C7EA4FE1AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700885, "uuid": "56f75830-87ae-4630-a614-88ff66f80161", "value": "3072:Q2+ZTOmlQnt1//F8mJIA674GHNFoo7Nt:QZZSnnakIA3QnNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700885, "uuid": "e261faf5-c8ed-473c-8ecd-625c1d5f8979", "value": 116164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700885, "uuid": "cd51c51b-86a9-4a0c-a931-ba9823c3a68f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700885, "uuid": "079117b3-f1a1-406a-8cbd-2aad5eb1cadc", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e12a516-e1e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766704884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704884, "uuid": "de5186d5-9bed-41f5-8025-8683b831ef08", "comment": "Malware payload", "value": "6623cb2bd23ef4697bcba20eed9fdd8c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704884, "uuid": "5d45ee87-16c7-474b-b52e-6e2e6d4683c7", "comment": "Malware payload", "value": "b45367eed9768f1fdbf27bdb2ed67368b2e385f745b465050921ad17e02be300", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704884, "uuid": "170e3d6e-0a33-4b70-894a-6bcbec419683", "comment": "Malware payload", "value": "62f69e9397ba7d76ad2358b4ee0ed192ca2033d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704884, "uuid": "0e99d8f9-284b-41d6-b1f2-6993178a564c", "comment": "Malware payload", "value": "c0b98d00f774db9f6681de17638ec49ca6fa87a137390de760ad936ad2a2e4516e7809cfc4db6203d36e3ad11af4acbe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704884, "uuid": "3a085557-eaed-4e67-b306-6b257ee4013c", "value": "T1E0B343C93FD2F474A391352B2D2BA05AE22E0C89770C8852C6A751D5FB5C718F6FA42D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704884, "uuid": "22849d29-b6f1-460b-9d4d-381d9f4428c6", "value": "1536:6D0Xlv5RhINwwLjZvLtRULQro8rcZNuVlTb0kkHctQPAP0ElnOZk6eDdb2dXks1X:O0d5neEmCc/b0ZHc6ZMK0Ddh4Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766704884, "uuid": "1ca21ce0-e007-4caa-addf-db3d832eac1c", "value": 109239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766704884, "uuid": "c5ed0920-de70-48c6-baaf-807c237a176c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704884, "uuid": "ee5d8b64-5404-481e-9a6d-8fc5f26273fd", "value": "fundtransfr mt103.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c15cdf-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766665202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665202, "uuid": "09134b4f-8aba-4964-a05b-b26c75f187d8", "comment": "Malware payload", "value": "8fac1ab993bc4ac8dc6fdd102746f780", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665202, "uuid": "17a332c6-b5a8-455e-b0c1-ce11f3e22ce8", "comment": "Malware payload", "value": "b55a3313a274af2a30c18024ef6eb131e98348efd5525dc98243411a8d135bd8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665202, "uuid": "506fa0c1-0b36-42a5-b071-bc133c99d669", "comment": "Malware payload", "value": "4acb8cc6c35cb90d47f36c03df0733dd6e333df0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665202, "uuid": "f5aea9ea-3a11-49a1-a81d-684f8e73bc22", "comment": "Malware payload", "value": "01e1fb318d36937d95fcfde2a807a6b826035167a9d6e2af80eafd1fc2bbc7fb69a2fe757fd89f69eef9f2379b3ad419", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665202, "uuid": "88bf574f-67e5-446d-8933-ff3a2da66a08", "value": "T1A1E026E277F0D132788C85BAA61C427898832D5BA9D0AF84D04F3DB26E0E948B057B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665202, "uuid": "13484df6-1906-4f85-bc80-4884d5ad1428", "value": "6:hDgMxeEUJtFyFqxtEzdbt76RzmFUOz80SOnKwn0qFHEOnKwNt0lBDpv:tnbY7kqxCzdbUw6/0FHE/qov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665202, "uuid": "86c21c53-980a-4d4f-ae3c-69056e7f5cce", "value": 333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665202, "uuid": "0663e5a3-0ab9-41a2-acb0-1226d6b8da2f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665202, "uuid": "9c8d8a73-502e-48e9-bcc7-c7f5a3727ebf", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc62719-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766672993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672993, "uuid": "d96051fd-d8e2-442c-a0c6-fbace50a2c47", "comment": "Malware payload (RemcosRAT)", "value": "e3e8865e473c66e8713044e263501cad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672993, "uuid": "23341f11-e702-4a91-b497-94bd9f2846a6", "comment": "Malware payload (RemcosRAT)", "value": "b5736a59dfdb009c5a92592f367a939aae689097eb1ecff6c02f2cacc09da66d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672993, "uuid": "e498b3c8-a108-48e8-a902-37bc21d95d0b", "comment": "Malware payload (RemcosRAT)", "value": "7a76f7d58b6ad89900609cfd9e3169a22a5d693a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672993, "uuid": "dc197054-d9f4-4471-ad06-bb08bf93746d", "comment": "Malware payload (RemcosRAT)", "value": "4404c80c7fc179bfbb6be81fd8a8f350d1d51578e0766c6fa104d3357ba52db7aa17ad57a5a8d1dff133bb04ada475f6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672993, "uuid": "11a969e6-9cf9-4a0e-b6f5-0b97182dcac5", "value": "T15F1615B22E1F08605B5E4BCFDD05657AF95330569CEB46B7F23060DC9B2C22DA251AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672993, "uuid": "7832efd4-7efc-4629-8a52-a8891599eeb5", "value": "3072:GIav47Qnu30yAvYYdms1CjDvZsYIfERTZCq7WKKKKKKKKKKKKKKKKKKKKKKKKKKM:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672993, "uuid": "9872a4f3-047a-4a3c-ada5-88462571e008", "value": 4405073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672993, "uuid": "56652cc4-5afb-4e3c-901e-f7f014fc6d4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672993, "uuid": "27a49889-88fc-434e-b7fe-e2fe0a055e08", "value": "ORDEN DE COMPRA 34389.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f712729-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690686, "uuid": "9334562f-881f-4d25-9aeb-a13d37a2aca7", "comment": "Malware payload (Mirai)", "value": "eb54525ca815d2970e19c661de561728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690686, "uuid": "c6957810-c96d-4612-95ec-84a09f029aea", "comment": "Malware payload (Mirai)", "value": "b73f11b823420512a8920058ee858f327ac13ac4e96bd015b17eebd88e01ebd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690686, "uuid": "168e88cb-f1e6-4043-a146-c8f641a4c348", "comment": "Malware payload (Mirai)", "value": "030f2be8469cbf134c914a895c1375c4efb9bc83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690686, "uuid": "51346336-6d54-47a8-9ea1-047308dc193c", "comment": "Malware payload (Mirai)", "value": "bb24fac53e109e82a42ce57dfec5fff94f4fbee77f29e55db5979315a50bf70e2c11b31d31e217ef7ec47a2b6944c19b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690686, "uuid": "93c1c213-e2a9-4c46-b04d-7d558ee51e22", "value": "T13293C45E6A274FBDFBAC463687B7DD209249339227D1E244D09DE901AEB034E384F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690686, "uuid": "7d66ba8e-793d-4af5-ae10-4e329ea4e017", "value": "1536:/qbXQ9r+4xSht0TBv8RVqULVwdCXk42lkHDGXWYyJ32BA8RAZ8SbrzjLW3NUSfTE:ibXuFx80TBvqVqU6cfsgVviRrx07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690686, "uuid": "3992b63a-13af-4347-8a31-04468fdd7958", "value": 92224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690686, "uuid": "5bed71ca-c461-4639-960a-f8f0bb509f8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690686, "uuid": "15068437-3261-432b-89d9-e2d44f7a2cf5", "value": "shadow.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae53b6f-e1af-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1766680585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680585, "uuid": "0de39528-d458-48df-ad17-ae6b6ec7869c", "comment": "Malware payload (LummaStealer)", "value": "fb75b4572d6698c8febcad33a82b0851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680585, "uuid": "fbb6838f-3706-4d79-a1ea-348f9713a086", "comment": "Malware payload (LummaStealer)", "value": "b7adc51025ca1c6503e0634a570b401cb947ceba42d440367790c976aa1c6578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680585, "uuid": "08cb5794-4cff-48f4-a162-455521887e28", "comment": "Malware payload (LummaStealer)", "value": "d28eb65430abecbc6d969f5b60056a9f04fe9a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680585, "uuid": "69b00aa4-6527-49ba-b87a-c788f24a0967", "comment": "Malware payload (LummaStealer)", "value": "c012cb0860e8cf32414ad7d672e0e66639f4110cf5f58559ea56cab2b9bab3d46b7a19da95fac9a3e2b21c2298e8cdd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680585, "uuid": "c4c1b960-b7ef-40e1-8ae0-704ecb915341", "value": "T1E2E30A2676E460B6D4F5137889F7829396317CA05FB682BF3284B7BD1E326C1A431B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680585, "uuid": "ead29f8b-91f1-4688-88f5-424f951a6f1f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680585, "uuid": "78af9a16-5888-4cd7-af76-237c22843ec9", "value": "1536:srae78zjORCDGwfdCSog013138s5gvhJh5t+I/D8Ih:0ahKyd2n31V52fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766680585, "uuid": "481a4846-5119-49d2-98de-81b0a54c7f19", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766680585, "uuid": "36fd7812-3e8d-422b-aa0a-330bb349cc6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680585, "uuid": "6b1c7f15-cda3-4314-a7b0-36de90059ed4", "value": "SecuriteInfo.com.Heur.6461.7490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73bc511-e12d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624691, "uuid": "530959ae-c339-4a33-adde-4ac2b80c38ea", "comment": "Malware payload (Mirai)", "value": "0cca2a3853db1834ddf3179599df4981", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624691, "uuid": "4983bd63-edf0-4805-98b6-0cfd5950e5bf", "comment": "Malware payload (Mirai)", "value": "b8a2fbe4255f70fa8a7e800939101581f7ca09293eb98c3194a63b2ca8ff7cef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624691, "uuid": "9bd62197-9c12-48d7-bbe6-9f1c796eadc6", "comment": "Malware payload (Mirai)", "value": "18e052f64143b01b7181a6446de83f14433663e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624691, "uuid": "5f81189e-4528-4f20-8c21-e627c5eed8bb", "comment": "Malware payload (Mirai)", "value": "0b273e28383dec07c069648f2a380c97a7e710dc07e74fd4f6a12e21ee158bd7a78a5adaa4d14337e23d8c4a85a2a2da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624691, "uuid": "a067d320-446b-4da0-9ef2-01ff53317fe6", "value": "T148A3D70A7B650FFBD85FDD3B4AB91B0525CD550622E92B3A3A34D818F24B25F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624691, "uuid": "d78fed3a-2dbb-4ef7-9a84-e6c36c5225be", "value": "1536:KLKwEtx8hxK9ZUXytxA9Fun1HYxrQOsH6h2gUy0g8MuNpHQEN91Am+Tw:KDJhE9ZFMoHYnsHYeATT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624691, "uuid": "768fdba6-4716-4678-8e0c-b4544f37375e", "value": 105276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624691, "uuid": "d7d36e2d-e0a7-436c-bad1-ac9a7ae20dfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624691, "uuid": "549aae39-2259-455d-9912-14b936c6a1f9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fb13a4-e17c-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766658622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658622, "uuid": "86e0cebf-1719-42a7-a2a8-d3e998f39d13", "comment": "Malware payload (ValleyRAT)", "value": "f864403b4e84d8bb103735b534d005c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658622, "uuid": "33932972-f026-4289-ac52-ef04eeb74c45", "comment": "Malware payload (ValleyRAT)", "value": "b8b2c70cc07953bb074c435e454943e8c9a0c61cdcba59a1d666d0fdf4fce824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658622, "uuid": "3ba8e80e-b476-4f83-9bc0-49714964a8d0", "comment": "Malware payload (ValleyRAT)", "value": "af0fb348e9e8abd4a77e7824831e9e3e1097c7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658622, "uuid": "1831e76b-ea5f-4183-a178-624fe6b839ad", "comment": "Malware payload (ValleyRAT)", "value": "a6280dc3d03bb5c72c532b4bf7b6a87d84194ed42606bfd80358467a0971c5471375261e1c10de8251d71ac3107e1ff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658622, "uuid": "1e60b58b-85dc-49c6-be55-0df3177a4012", "value": "T1E5B36B2172A0C072C097253199F9EBB24E7EF93117B844CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658622, "uuid": "bdf8441f-1a59-4a7e-a089-93d11ab454d4", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658622, "uuid": "cd93d3e5-ab50-4571-a062-ca38b943cd10", "value": "3072:ybWjdIPbcia0NFtwwnILn3py6D268XEPKD2:ybWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766658622, "uuid": "bdce8397-d27c-40da-830e-1616df5ed72c", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766658622, "uuid": "136b81f4-df67-4cbe-bb6a-09a1f59fcc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658622, "uuid": "c3ab7001-236a-4131-82a2-2c8d503f2129", "value": "b8b2c70cc07953bb074c435e454943e8c9a0c61cdcba59a1d666d0fdf4fce824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f68078-e12d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624418, "uuid": "ae5268dd-3b6a-489a-b169-ad9b6a4436e5", "comment": "Malware payload (Mirai)", "value": "7c34c9441a1245312a839cdc4c6dd3a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624418, "uuid": "7f60f2f0-4045-4cc1-b401-c5bb74f49621", "comment": "Malware payload (Mirai)", "value": "b8cad988a2ec304d97b01cfc7bde3fd2d7182d6df39782ac3891053e453e4bfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624418, "uuid": "945591eb-33e9-4d91-b65c-21e997bdc174", "comment": "Malware payload (Mirai)", "value": "45ee73b58f2223c4742f8a69a72e34308b514009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624418, "uuid": "c1a0399c-e906-4963-b153-19dc6a28c19c", "comment": "Malware payload (Mirai)", "value": "047b34bd811c866a9ab7944eb2111fcc06d375d8f926c982ce037f9bcaec6875763f69dd55e632d3f982965aa0ab7453", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624418, "uuid": "28ca9b30-205c-4559-8bff-3b827a03cd3d", "value": "T159731885BC819B26C6D4227BFA6F428C332663A8D2EF7203DD155F15778A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624418, "uuid": "c278d500-82c6-41a6-8dda-ed6671b71588", "value": "1536:INOCNw7AerIb8l2hBwlqb7DX9AJELW1Iy8cXckkIBTw:INpqRQ7DX9AJELvy1Xck1BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624418, "uuid": "1fcc0764-0ca8-44e9-9780-c835afa6b9aa", "value": 79040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624418, "uuid": "dd283516-8b70-4beb-b168-bb8eb1f60d91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624418, "uuid": "be91d1c7-6cad-49cf-b90a-b7db56db550c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017deb99-e1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (DiscordRAT)", "timestamp": 1766704272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704272, "uuid": "783bd503-742c-40f5-8273-d6190be4c23e", "comment": "Malware payload (DiscordRAT)", "value": "35b4414e479e2cc7aff4d20d75b7b0f5", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704272, "uuid": "05ca7f57-f0cb-4702-9f1a-505dda0a60d2", "comment": "Malware payload (DiscordRAT)", "value": "b993ffe4b599c0c3f3aa9ab917d2866f88297cc46e0702d3dbc405d46854fd88", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704272, "uuid": "45f4c167-8219-465d-8f3f-ef5991c282b8", "comment": "Malware payload (DiscordRAT)", "value": "b8de97bf42cb4cfa0bf468d24df9615559c08422", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704272, "uuid": "ad7fb8ae-20e8-41da-90a8-2bc004a7dfbe", "comment": "Malware payload (DiscordRAT)", "value": "c71c14c879fd5d82f71af952089746891ac0cdd1ceb53d7662ff9b9ef5535cb90efba6c55716763c901528e3f1be054b", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704272, "uuid": "095268fd-09a9-4cbb-ba2f-99efa4cec70a", "value": "T16173B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704272, "uuid": "2e0f656e-235e-4e79-a9c1-c30fa54132fd", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766704272, "uuid": "1bde5b87-2c84-42a3-8b1f-f526f6bb5e13", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766704272, "uuid": "a207dcf3-2cc6-4bad-9225-d4f431bc959b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704272, "uuid": "a5dde4df-569d-491e-bf14-9843eeddf0af", "value": "OptimizerV1.0Free.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73f0d93-e12b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766623885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623885, "uuid": "5ee70c2e-80d1-4d62-930c-73a33e69331b", "comment": "Malware payload (Mirai)", "value": "13e92d46ac1ffa4d9d2153665b72351f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623885, "uuid": "63484bdb-0a4a-4cc9-aa15-ba0575977e46", "comment": "Malware payload (Mirai)", "value": "b9bd8c3bc138f3a2cd136b6224358d2ac7f4a779efe65e5b8c96458e79950e88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623885, "uuid": "019a57f3-2961-41dc-87f6-09c2dd6f924a", "comment": "Malware payload (Mirai)", "value": "f6c74045a2d4f9f32bcefca0bc4be5dec9259ecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766623885, "uuid": "11e67ffb-6cc3-419c-9622-4f6f60933f71", "comment": "Malware payload (Mirai)", "value": "9b097231a936cd828e0a5dbd70edab60a8f5fd6dbae38300ae8bc147b7f1e7892549c8932f3bcc5beef8cb712e996a27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623885, "uuid": "d91eb0b0-166c-4d58-97be-144f49110339", "value": "T1F4832985BC919A12C6D423BBFA2F428C332653A8D2EF7207DD255F15778A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623885, "uuid": "08dfb979-a310-4282-845d-58a50f16efdd", "value": "1536:RdmKVoninjCM3ZYE6mb/+L+vE7KMic6Avo6YMYDwFxvSTw1:RdRC0ja+vE7KMic6H6hYwRSTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766623885, "uuid": "648e3971-42fd-4fe3-aa4e-836eefc01645", "value": 83136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766623885, "uuid": "1df3e40b-1cc2-4076-b6e2-24a3441eb124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766623885, "uuid": "49cdb8bc-729b-4282-95e7-c7461f5f6a1f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c39081-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641224, "uuid": "0953e8e6-dcff-4971-8302-bd8afc5c6778", "comment": "Malware payload (Mirai)", "value": "482e57fe1edf5d694821f23c3dc911ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641224, "uuid": "16684f8e-d5d3-4b7e-80e6-4e0842eaea49", "comment": "Malware payload (Mirai)", "value": "ba88291af8b4128aaffc81c02450fbdc98b42881e6f0328902a0b642767b0831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641224, "uuid": "0781f4bc-b42d-43ff-83ef-f838fb8b1389", "comment": "Malware payload (Mirai)", "value": "74fe216e590df90b5bf11d888827afb2c194dd94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641224, "uuid": "8785edd9-6641-4954-b01a-7883ec0f3514", "comment": "Malware payload (Mirai)", "value": "cbff51998971a47db7506edbb1ce44456180f22cf208ea1af522762d5315d76a5e5848fdf70f401695837db9c3ad1f6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641224, "uuid": "e24592e2-0f91-4309-807c-e8dc71b3619c", "value": "T15F54891A3E22DF7FF66D867047B78930569876D62AE1D584F16CE60C1F2028E241F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641224, "uuid": "96a887b5-2d1b-4dc0-b619-566222bd16ea", "value": "6144:MILlMEl/9nUy+MtLy58TrMJ/VSwwsfFqjVI:z9nUIJjrqojVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641224, "uuid": "56f4b013-b704-403c-a5fc-064e78435da3", "value": 304652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641224, "uuid": "fed0eb78-9865-4948-b6ad-bb46fbf77557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641224, "uuid": "7bee252e-9dff-4dcc-bc7e-d131332d1a52", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95871fdc-e1c3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689059, "uuid": "b204a3b2-1791-4a7e-8ada-43e9d675d7c0", "comment": "Malware payload (Mirai)", "value": "4e3f8049004924235f544effd5486fd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689059, "uuid": "13a88713-30a0-4157-a05a-d119dec46b06", "comment": "Malware payload (Mirai)", "value": "bab8cf949e8a5c9f0a186ce6eba31a86f95b74e856e1c0bb507ec60614169143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689059, "uuid": "94863f26-9968-4ed0-9081-8e2e478d64c2", "comment": "Malware payload (Mirai)", "value": "3a4140e9b204959c7031de31af745d825bbf0b5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689059, "uuid": "7d147fc3-b447-4f27-b131-83d38a924e01", "comment": "Malware payload (Mirai)", "value": "fac7954b1c5a338316569da97b856006e6869ba48b0a4208aebff0eb3a406a03371203da8049c381f85e84cb69e061c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689059, "uuid": "3960792f-1858-47b2-b431-9c78d2d5c74c", "value": "T1AF63C752B8819117C9D8A2F7F71E019E331513B8D2EB3303AC356B613689D5F0EA7E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689059, "uuid": "e3a7dc8f-2a67-47a9-8bfd-32275d965c33", "value": "1536:J0fzMkbpyHWMHsRth7SI9H89Yv6V8edz5b:J0fzMypyHWNV2SH89YJedt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689059, "uuid": "b0eed7e3-1a50-418c-ba83-14416800ce00", "value": 73368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689059, "uuid": "b41a4529-3b14-448c-bd11-b7b4aad1a8ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689059, "uuid": "8b976f1d-4b95-4b9b-ad9c-99e27a2455c8", "value": "shadow.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6b7a6e-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626072, "uuid": "fd48106f-d6c9-4aaa-bcbf-639d391966f8", "comment": "Malware payload (Mirai)", "value": "f5f81e9c07f7b5a72e80a3f93973847f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626072, "uuid": "edecb7cf-133d-48b5-ae8d-5ea15704837c", "comment": "Malware payload (Mirai)", "value": "baf5208fddbb85feddf5c52684671059656d59b7e72243840d90fe47831c1237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626072, "uuid": "30ee446f-a16c-4523-989a-b0b164891d28", "comment": "Malware payload (Mirai)", "value": "1711046c86001ac0d5ccd671d85b80d135a6b670", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626072, "uuid": "9e347419-baba-492f-969e-4ba1809d3b9f", "comment": "Malware payload (Mirai)", "value": "628239d09f88d1addb5a35d27d1d517bac28f5413ba4c049ed49f0eb7c3ef2501f6af678b53adce0d938ef89f5b782e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626072, "uuid": "522f2e8f-123e-4cc9-ba2e-c474ec1439aa", "value": "T1B8A2D0B0CAE57E92D6EBEC315CD4D9D417E81DD52E2A0AF934C56341A20A636FB04CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626072, "uuid": "67aa6c01-58b3-489b-a0d2-bb3b865a7750", "value": "384:4UL7JIgYJcmNjagkKSwqbdA50kvZff8Cgua6MIv9GTRiSrkV64DFM4uVcqgw05Vz:vylvLSwqbdCVf8rua6MS9KiSh4Dq4uVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626072, "uuid": "d2b336a7-0441-4b13-b635-7bdecde3ebab", "value": 21312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626072, "uuid": "11ce8ae9-ff7e-4b10-b74f-d60b93e3a0ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626072, "uuid": "4872fe8d-a7af-429e-8222-84dd5f2e4267", "value": "0.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209e429b-e1e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766702177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702177, "uuid": "1d489e53-2c23-414a-ad12-85c626c55874", "comment": "Malware payload (Mirai)", "value": "30cd1a14c5c29127324738ca2519b3c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702177, "uuid": "02a97ff9-c7b9-4ee8-a8bc-69afd6d67c34", "comment": "Malware payload (Mirai)", "value": "bc69477065772e3e8643bfab5630392aebe1d1f6933d92379fd5888222928e4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702177, "uuid": "17f2c9b9-e42a-4ffc-936b-ce046223344a", "comment": "Malware payload (Mirai)", "value": "912ed7839cda4c985f9a9af4db47881fc3f5eafb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702177, "uuid": "5d56404f-5510-4704-8dd2-f1ce7d799b0f", "comment": "Malware payload (Mirai)", "value": "f53b7ba447c430069927a33eb0681fbcd575062a96cdef058884e3aff6ef5f5cfc60f73ecf22d382f26a60ad32792d3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702177, "uuid": "473c9e0d-3ebe-446e-804c-3d8e19101add", "value": "T132331A99B4019D7EFC4AE77FC8120A08F630775522530F3A66EAFDD36D321948D66E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702177, "uuid": "45da7f6f-e3d9-4447-8c82-2c70d3f5a1bb", "value": "1536:83CWr1KCeyEWw7Q+j3LRYx8QnZDAAKBUjq1fpE:83CWr1XE93uN9KqjIRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766702177, "uuid": "f2cb8132-50e8-40b0-a324-2ef9e0ba6f3a", "value": 52116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766702177, "uuid": "c649672c-dda1-4c55-a6a8-b91dd4e4828d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702177, "uuid": "bc41c57f-6228-41cd-bd06-7f59fed35951", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61436287-e199-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766670932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670932, "uuid": "850985e3-5510-4bae-8c19-eeaa7feef4be", "comment": "Malware payload (Mirai)", "value": "e2dbd89c77ed2578b88db3a9033297ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670932, "uuid": "7c1bea94-9ced-4629-ba0a-42f00d2df713", "comment": "Malware payload (Mirai)", "value": "bcb05b54551930647a2a004bbc33895146c3600ba07d15dc6a7a440033371b4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670932, "uuid": "c6900089-1420-4a82-b3ef-cd6d34391c6b", "comment": "Malware payload (Mirai)", "value": "c79807f29491379e665818a4959d8f960efe8ea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670932, "uuid": "0c047925-33e0-4baa-a6b4-ee161efa4b16", "comment": "Malware payload (Mirai)", "value": "fba0a7de65aa9b83c9e70758252d67577bf6cbe6cc17cc3334084852549e11b15362ec7e109be9f461dcd384b06c8129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670932, "uuid": "4bcf6b17-1145-447e-a8cf-25261c0fa173", "value": "T192834A22B9791E2BC5D0A87B21F38375F2F1478E25ACCA5E3D610E4EFF2464026476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670932, "uuid": "87a25ed8-9915-4620-a507-df6dda2edc6a", "value": "1536:1mezQqXQXLimSvpCSH/xaFvwN4XWzmv5tmZYl5hQAtvy:Sqi2bgBXWzKUZYXaEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766670932, "uuid": "82651b07-c5af-439d-81bc-a57c2af1fff0", "value": 87608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766670932, "uuid": "8388c345-a455-49ba-bd92-2e6b8fe9e569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670932, "uuid": "0b463302-edb1-4add-a4b6-83c5723685ce", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d937ebc-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766690334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690334, "uuid": "128b897b-55a2-4f57-96d5-3889aa86648c", "comment": "Malware payload", "value": "9135947c21ad7e9570c0c919746fae83", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690334, "uuid": "e6d387c4-3fdb-43f3-9488-6bc11970eb1c", "comment": "Malware payload", "value": "bdc55f105a191475f87ff381d1131d71f76f5b3f986dbe246d4eaa5c841a6b44", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690334, "uuid": "be7a0f82-3178-469a-a1ff-311991272712", "comment": "Malware payload", "value": "5e9a62453d57c002d96346bddae5c80e52a65c4b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690334, "uuid": "f1e2ac16-ae50-40a9-9aed-2f7c05f0b1a9", "comment": "Malware payload", "value": "acfbabeb08ff7fc43c050b7e989c8cb6e958aa08d1c8ba05258580fa6638dc361c3f55758a6d3515f3c58c8cecfe9bd8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690334, "uuid": "75ad62ee-ea2e-4345-bc23-33f03dd1d348", "value": "T16F1163CD219152375A08DFACE57B800C95D6B8C2ADB0EE79E4941D3ECCDA72D3038676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690334, "uuid": "7c4a27b0-cfd5-46c5-939b-9c80a83c0249", "value": "12:oZXWsJ/mbGN/UMN/fu8NIl5ON/ia0LK3N/WtODOmN/OpiVN/cObzN/yWSvGN/otN:mYp8NI7HKlDSiR4WAVttdSPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690334, "uuid": "b91ed639-c654-4b5e-bb68-3cc55040dbf1", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690334, "uuid": "42af08b4-8f6c-429d-8183-6826456d5044", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690334, "uuid": "55ec8454-1fcd-4039-8d2e-f1665367103e", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cb1388-e1dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1766699951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699951, "uuid": "555e0fd8-373c-42e5-9d09-2af903b775b0", "comment": "Malware payload (Adware.Neoreklami)", "value": "9cd4a1bc54e137ad80a3e9a54c332f7c", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699951, "uuid": "1241c9f0-a028-4784-8d65-a3eafd7bd57f", "comment": "Malware payload (Adware.Neoreklami)", "value": "be2d19257ed33d735165ff45dbf64cc1f82660b39f26e1a046e9916b14ad45e1", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699951, "uuid": "148064aa-05b8-4675-917d-0839dc9005dd", "comment": "Malware payload (Adware.Neoreklami)", "value": "9445873fcab52cd000640f535439bbff9e595b71", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766699951, "uuid": "dea94829-933b-4223-b68a-e1e1f432388f", "comment": "Malware payload (Adware.Neoreklami)", "value": "048f0bdf6fb0ca64a251fa256d7c2be36ba8c3ee37d56d7051dda2c1e81376171b3cdd4fc7ae8dccff1ceb6d84372b3d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699951, "uuid": "98b9787d-e8a9-4f0c-bb7b-e6ce75cfbc2a", "value": "T1287633117CFFC6B7C1FA5237E5665EA3A1E2824242228C5733CC483C9E7956ACB0979D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699951, "uuid": "f2a42ae1-24ce-4db8-9a42-dcd14fa21dbd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699951, "uuid": "0eaea8f1-6c54-41a5-8277-bb5e367ff1d2", "value": "196608:P1O1BrINk5QnwwXzL+txsyxfUuELvC777fCg4Ym1XyOl:tO1BrIvxXv+vsjrG7DiYs5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766699951, "uuid": "bca3f898-2c76-494d-9c75-8ce03b82ecdd", "value": 7501041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766699951, "uuid": "4e88369a-5f1b-4ac4-b8e1-c15431964441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766699951, "uuid": "f2e3a342-104a-4827-a5ce-bd67b8e56af4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64cc7cb-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641493, "uuid": "9fd5b203-1b8f-4616-be7e-9b0ea8fe0b71", "comment": "Malware payload (Mirai)", "value": "a5c9c42558e415f88709305e0b5e9a76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641493, "uuid": "92406b5a-049a-4e99-9bca-cd4173e7affd", "comment": "Malware payload (Mirai)", "value": "befe941924a877ee59be326c138cdb4ac31b8b23b3effd502901de69c9b79b27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641493, "uuid": "7ae3835d-fd57-4b45-8713-4e565e50910e", "comment": "Malware payload (Mirai)", "value": "77aef5bdec529db1bd21971cde52b5e03e519b71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641493, "uuid": "700f54c9-abb6-4f8d-99ed-95e9fd4353e4", "comment": "Malware payload (Mirai)", "value": "5e5c001f7d8bcca720d1393c94b0cc98415493bfedcd14734342093181246507e69fdbb10d484eb508cf66e9c9bc8953", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641493, "uuid": "95535ef2-0c02-4a1b-b36f-b93b3f673419", "value": "T115736BC5A653E8F4EC1606716137FB365A73F03E1028DA87C378AD36AD42A42E54739E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641493, "uuid": "ae897a26-c261-44e0-9320-c6bae5a2e746", "value": "1536:whBOu1J1A/mAjkTUJuUkAwI/oKd1T6NLoD6B3UHqshkbmU:COwnA/mAjkTUNk9ErXTooDakKqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641493, "uuid": "edf18447-dfac-4e33-a898-75acd6ea4a81", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641493, "uuid": "82f676fc-b43a-4f51-97d0-3f48ef846849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641493, "uuid": "1a8c38cb-8347-4016-b70c-fb6ef1ebc9e6", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7987b3-e15d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766645075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645075, "uuid": "b45ff2fd-234d-4acd-ba44-c484bb4bfa17", "comment": "Malware payload (Mirai)", "value": "947009b60e0636b3f9639d158abf56af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645075, "uuid": "69e48bb4-99d6-41ea-ab35-6749f833529c", "comment": "Malware payload (Mirai)", "value": "bf4a0d813f549a57c2816105f435b97532058b002c1790e7ac8dd2aaa2e8a0de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645075, "uuid": "31d7c508-8489-4745-9c98-fa0249e3a8bd", "comment": "Malware payload (Mirai)", "value": "be9e343ba6db5d939d1f5fb8e11b9d5d71e1f577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645075, "uuid": "3932e889-5fce-4ee4-893a-8771eeb64f3e", "comment": "Malware payload (Mirai)", "value": "b8fe5b0638cfcd5aa6272aa268b241b48e476dc4ff9e13c4bbad0ea5ade113211bb468665e07360b739acb3cdac8376a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645075, "uuid": "f5b6d381-24d6-4394-8654-1809784bb77b", "value": "T13C934A02771C0A43E1A25BF02A3F27E093FEE99021F4FA89690EDA465175E375586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645075, "uuid": "ebc8a511-3d81-409b-b3c8-671ef3a9d488", "value": "1536:MfSH38t+66xN6AHFXR5SnA5HRWKcB/WOPMyuNR18isMioXqs3Xh:qS3NL3InURW1uOBE8iNisXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645075, "uuid": "c1731ceb-b00b-4b17-bf9f-6aec39cdbc3f", "value": 91788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645075, "uuid": "b2d7eeab-fac0-4233-bf25-bd2e035c1030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645075, "uuid": "444a31bb-7b7d-426e-9ab9-d4241b2f0b34", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28f11b6-e166-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766649272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649272, "uuid": "c4b614a9-6ce5-4c29-9128-c98a74c1c27f", "comment": "Malware payload (Mirai)", "value": "cd1c61ea8c70033f4b4e1546966e76eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649272, "uuid": "3c4cd9f6-1020-427d-a2d2-903304219e27", "comment": "Malware payload (Mirai)", "value": "bf6af0360bf6e5c401b8b666c2bd2ee8581bb0d17ad9e69590a6bd4b885c556c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649272, "uuid": "da42af59-0c9a-42d9-8233-4a76b4598b0e", "comment": "Malware payload (Mirai)", "value": "9f3fb4f505ceb96828d05faa3383f01ced62a123", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649272, "uuid": "511e439f-e133-4da3-807a-6ca64f82faec", "comment": "Malware payload (Mirai)", "value": "894eb96eb95efd5e7e12f539a60ee5fff3a2f45f72df8bf44367ea280cb3a1aa65d94ac8bab5be8790c121e437e479ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649272, "uuid": "8f993e54-6ac7-48cd-a506-56342b940d18", "value": "T1E7339E72DCBA6E54D52C1AB4B4318F7E4B135100E7872EB655AADA398003D8CF95E3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649272, "uuid": "0c0bcdd0-ad2d-4ba4-9be0-491d351fa5c7", "value": "1536:V013AS7Os7odzCUd95IVXx/HlCJSpqNTw:KRR7OLprdfI/HlkUoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649272, "uuid": "b3c9d556-91f8-4029-a732-c0b509f69436", "value": 54444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649272, "uuid": "2885c79a-8880-4873-b92e-9bbbf827cfd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649272, "uuid": "90b9c8d6-d585-409f-92a7-4938ec9d4666", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c23d91-e1c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766688339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688339, "uuid": "84695a4d-4bd8-40ba-b1a6-b76995a72070", "comment": "Malware payload (Gafgyt)", "value": "b439b65cfd8ddce48a82e3a13d9d52f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688339, "uuid": "fde99400-0961-4269-8944-c4c1b3447f49", "comment": "Malware payload (Gafgyt)", "value": "bf968c82d5b53efb81ed61da576b347998077feebf004514081ff7efdfcf9545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688339, "uuid": "2203e094-b602-447f-aa69-f41c988fa2e7", "comment": "Malware payload (Gafgyt)", "value": "c1583180a52da578c2033f471203fc52ffef4ad3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688339, "uuid": "50dba74f-6bc8-4024-8734-54161a9da46a", "comment": "Malware payload (Gafgyt)", "value": "56a86d6a64957cbd395cb59281aa5694c6a862003b2d55ac43266a958873e7bc459ae36dd0fb284098dc6831c89d57bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688339, "uuid": "2de84050-c1a1-4745-a5f9-448a126690f2", "value": "T170057D1AB1F3A67DC007C03087DBC6B15171F8752A322D7B26C4FA342EBADA51359B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688339, "uuid": "14e2dca5-6bc2-4cfd-84be-9d812a54b1bd", "value": "12288:mGtYTs2JD1NglL6tT/EQmehdsH7N7clguPnnWmN2ayfUVHXRB79ZSXQw:m8KrD1Ngo/Nm8euPnWmnbN9Z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688339, "uuid": "ffedfd16-b579-49b2-bcc6-c0c1f335ed98", "value": 869792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688339, "uuid": "deaea2a4-5cf0-4c2b-a2d0-cba8ad5cb2f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688339, "uuid": "16e7ed01-94df-4f78-aaf8-6476ad24ec1a", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cb2977-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766694029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694029, "uuid": "8b238685-a04a-4e0c-a772-3a607c75ece9", "comment": "Malware payload", "value": "90520936b8616fbb6f800820001d6c91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694029, "uuid": "95c534bd-daa7-4258-adc0-4776a2bd1bba", "comment": "Malware payload", "value": "bfc78f5f0ba88fe2e92caba906cd21b5ed41673fd68ba4117e6f5b8129bf57c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694029, "uuid": "7d2daccf-31d8-401f-b2a4-b4aab9109101", "comment": "Malware payload", "value": "f5806179d36dbc66cc536f08b969a4210e523504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694029, "uuid": "a567e7c7-9121-4be5-8dd9-ca00455f4f32", "comment": "Malware payload", "value": "2d70b3102b04f3171e699d86cf68b9df59faa235ddbcc1c7b8abcb09cca4dd0e2e30cfe799d9ddf14eb91aab9c12915f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694029, "uuid": "6b37bc68-0923-4b1d-a1f4-e0f3d8cbf272", "value": "T1EC531B1AB35364ECC62AD57486EFAB33B671BC634630AF3F02E4E6702E11E601E5E515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694029, "uuid": "1bc0d6c0-2b8e-48bf-9389-2488826b6863", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694029, "uuid": "11b7a550-aa0a-4ba3-b0ec-1c1f8928cd6b", "value": "768:k5oPCAeG58IK4PCVzM5S01Qu0hsewzRxUsUlmPX6puv/1bDeI4t0gOiATWhea:4oSzI9HHKrKcPl06Ev/s0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694029, "uuid": "79334ec6-a066-46ea-86e2-0055b49c2957", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694029, "uuid": "69f8d649-1d11-468b-871b-5367ae1dcce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694029, "uuid": "334e51dc-0942-4d85-bb68-8395f7a507b0", "value": "SecuriteInfo.com.FileRepMalware.25994565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa05d1c7-e1ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766693952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693952, "uuid": "fe26c8a2-6fbe-4dda-9b7e-9c64df54484d", "comment": "Malware payload", "value": "df269abce081869c5b99be2ea7b9e8aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693952, "uuid": "af24761f-5ee5-40a0-a5e3-a7fe2fc8dc04", "comment": "Malware payload", "value": "bfc9e3ef619c60fde95cafb3b071837cf62b9252210f481fe5135d90d0289092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693952, "uuid": "cad1fbc4-79d3-4b66-8ca4-3b137c1795b2", "comment": "Malware payload", "value": "9e7f20f9b190fd240d3dcd81c8380a5b6dbddd77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693952, "uuid": "7df8f4a3-9268-4c7f-ab01-bbc997e3893b", "comment": "Malware payload", "value": "c275461ca39e3fd6a40bf3cbfec11eb62cd7fb009abee085eade5bffc47105c6afdf383869326003c91b0320b14a17fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693952, "uuid": "44759ae6-dc95-43bf-b58d-c45c391e18eb", "value": "T119D2E10467F507ECF2EA0AF02A26D65A7E5BB8648770D76C0C7110EF3964451ECE8B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693952, "uuid": "be451684-27af-4d8f-b66b-3d76c948b200", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693952, "uuid": "4db04b76-ca43-4cd9-b211-f603c8bd5c53", "value": "768:wLgoCUoNkomWuC4a7+9CamhL70zvLuM1LZRMbis+l:wLgo8mWVCslczvrZRf1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766693952, "uuid": "d8504f7d-f7c3-4fc2-a297-efcdf276bd0b", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766693952, "uuid": "f869cd07-e255-4c1a-9a80-9c7e67635142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693952, "uuid": "e46d96b8-cf5e-40b9-96da-76bc293604ed", "value": "SecuriteInfo.com.FileRepMalware.25994565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaaf54d-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690873, "uuid": "7d6be8fa-cca2-4fb6-91b8-d55de591c653", "comment": "Malware payload (Mirai)", "value": "efbe12fbe2eb002f30ba9d50bd04022b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690873, "uuid": "41781013-8cb9-46a2-9601-a7a6c2577998", "comment": "Malware payload (Mirai)", "value": "c0e594e675960d72aca63efa981fad3ea07ec27994cb4ab0c897ccc9d886e35f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690873, "uuid": "f5c0ef1e-e5ea-41bd-8980-27a15b1bebaf", "comment": "Malware payload (Mirai)", "value": "3c061e1ac5d60cdfd86f1c609bfd7c72bad55af7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690873, "uuid": "baff1a03-7636-4a4e-ac73-a4f456b720f2", "comment": "Malware payload (Mirai)", "value": "31d5d329335527a2b06f239edd899153290b4401ca758e5d47f89456e57aafe54429891ae3b9a6e93ad5d5024ebaa9ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690873, "uuid": "fee5804c-c513-4beb-b63c-4193a769aac5", "value": "T11121DF00F2191463E6E13DB037375B6157AA8F031B2945089B9FE29ED8B9C205A8D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690873, "uuid": "bfb1b4c7-2412-4c60-8d1d-069ad9aeb46c", "value": "24:3WUpWS9nSWZ6S4/KSwISBd6oTKP5tAFltf2qzktId6vy5MaaTo0YGPGhV6JJ:GVgZVbXGApfjz2Id6vy5Ml2hVWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690873, "uuid": "d948bfa8-005f-4ab1-b2b8-fca048f8681b", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690873, "uuid": "2c051a4e-c4d0-42ee-a65a-9669b4fc6203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690873, "uuid": "9eecefd4-a4ea-47b7-b667-8887ca7bb1e3", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af19280-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690329, "uuid": "f98a8411-39be-49b1-97fa-09f75c6ff8cb", "comment": "Malware payload (Mirai)", "value": "2e62321ac95f71455aa9e4112861ec72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690329, "uuid": "97980a78-d050-47aa-b023-557f89dc8e22", "comment": "Malware payload (Mirai)", "value": "c0fe3a9a893f48296e27f62bb47a35480d0255c5df46d2185963ce8552004535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690329, "uuid": "85e26b12-51fe-4407-86d6-db3d0c300dc2", "comment": "Malware payload (Mirai)", "value": "b2b1f96e73cb3d178389dc4e2a442b72e258b520", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690329, "uuid": "1da6c0c9-5a05-461e-9f88-e79721ea3058", "comment": "Malware payload (Mirai)", "value": "262b91fba06683ac437e3052846e50c6cf4c784914db9cdfa37a9f2b5e8962713c67b65b0399cd1318837bf2d24dafdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690329, "uuid": "d15eb930-0472-4296-8477-d1153954857a", "value": "T166C33A02F58584FCC4CAC134076FA63AD936F1DE1238B2FB6BD4EB163D4AE605A1D994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690329, "uuid": "b57f120c-9a7b-4297-97fd-a5eb4bbdca3a", "value": "3072:90AP9gwmqzhp0I93ihWEa9sX3KfwthTDDBEjHw+zQQwMAFf2DS:90Y9gwmqzheI93ihXa9sX3KfwthTPSzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690329, "uuid": "c460a252-12f9-4c4d-961d-bfa067157bfa", "value": 126848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690329, "uuid": "9917752d-2969-4796-8b59-258c42828e40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690329, "uuid": "3779ea78-6236-480e-97e8-87c1e6e2ec34", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698885a3-e1c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689414, "uuid": "c9fca95c-3cf9-4727-9458-e20ae241b1f5", "comment": "Malware payload (Mirai)", "value": "be78d6ef0f2ae7593f631cc2c22b4327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689414, "uuid": "ac74dd81-faa6-4f1a-8179-e4c792e00791", "comment": "Malware payload (Mirai)", "value": "c15d71dd42c22c60178a30243c7f57c891ef83411a6997138ef8182aa8a4f10a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689414, "uuid": "209f3850-7500-4d98-b931-b22158fde00b", "comment": "Malware payload (Mirai)", "value": "762b034f200edeaf28fec1afe29c86beacc63076", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689414, "uuid": "5a8e7c2e-c541-4af0-abcc-5018a655bdda", "comment": "Malware payload (Mirai)", "value": "87747d910f7b3ffd5c459a7b36491b1b928ac16a55879ee8fcd5f2869784116e2c7dd668be6e178c37d889522ad97fab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689414, "uuid": "6d70bb0b-b4b0-4e36-b185-da84411aaada", "value": "T1E6D47E98FE5E3C42D2C7E27CDF8A47A1612BB1E4D72681F23941525DE8C9AEDC7B1201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689414, "uuid": "48fdee40-f242-4085-b746-98cab9e8dd5e", "value": "12288:GHuuIcM0e+CUHmlLovzlV2svbyJf8EncBLw5VYQf:G740DilLUvGf8RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689414, "uuid": "ec0707c2-6e77-4fe8-919a-0ad5b805498f", "value": 597584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689414, "uuid": "2d6460dd-7d8b-4201-8a3e-89f056aae619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689414, "uuid": "3b0fb216-3c05-43fe-a88a-960124db9e8e", "value": "shadow.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb29295-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766673319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673319, "uuid": "c2668eb3-34f7-401c-9af5-a13676dc1c1c", "comment": "Malware payload (AgentTesla)", "value": "86ecf0ea65d920583df855148c359374", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673319, "uuid": "30797a54-7d38-43a7-8089-33011615eb7a", "comment": "Malware payload (AgentTesla)", "value": "c21141b93ad3f425aeea12485f6a1bedcf162738e7ee3e23e15ba803f9bdc444", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673319, "uuid": "57297eb9-fb0d-4a78-afff-d9dc8415f089", "comment": "Malware payload (AgentTesla)", "value": "ec84addb95de305027f8f13e3caddaf2be67284d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673319, "uuid": "99bbfb03-a097-457d-b051-0116b66128bb", "comment": "Malware payload (AgentTesla)", "value": "fe50a720b71332d4f8718fbd210864d79d956575ea729604a3cfd909b2f2f6f9551cf7cb2e2f835862fb643b99c38529", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673319, "uuid": "ea2ba397-4bf6-4a3f-9002-8ca55c981a77", "value": "T12A45F1214DC46FB5CFAC591840BE261E97E00A9F8466744AFB3BBD47AFB7A44020F1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673319, "uuid": "5b525f46-ce0c-45a1-8624-7ed9a64b2688", "value": "24576:1VJ6oir0H24SMN+dZAtq2HuUakGM9+/yG76GZTMeOx:1mPr0H2lhGtbGNXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673319, "uuid": "981348f4-18f2-4ed2-a8e4-c98b53b41dd0", "value": 1272068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673319, "uuid": "d658c152-cf0f-452c-a1c2-7d1ffa03531e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673319, "uuid": "325b9a8b-db60-4c4a-a184-8f4fc1ea0e42", "value": "New Order 12242025.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6332299-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Merlin)", "timestamp": 1766666377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666377, "uuid": "9f622d8d-7f9d-4c88-9869-5dafa7354bcb", "comment": "Malware payload (Merlin)", "value": "c22c3acb5bdf0d66dd9a4c849fa0a894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666377, "uuid": "e7626b07-875e-4c27-a93a-f1572cb30ab6", "comment": "Malware payload (Merlin)", "value": "c2a3b773038440c4d9ca129ac8ef6f9afe2bc279e2221a09e312d2a738aa6762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666377, "uuid": "ded33881-f7b1-4ea2-9b1a-8283909670e1", "comment": "Malware payload (Merlin)", "value": "ab721684c6bd15f25c910036b8c96a307a0e4d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666377, "uuid": "468fa470-c62c-4d07-b38e-0702c2da527d", "comment": "Malware payload (Merlin)", "value": "08f5b51921e1d8ab616b301d1a6a4be0b68b217b225bbf20fb202d275be17cabba158c2a54fc4144e38629b0b65a368e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666377, "uuid": "aba3fb8c-2cfa-4f14-8e85-2beff7425c42", "value": "T1EAD65B07F8A145E4C1EDD134866A9263BA717C499B3523D72FA0F7282F72BD06ABD740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666377, "uuid": "0af05014-c190-4360-9315-1fea79e70315", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666377, "uuid": "f2000b9c-4d4e-4794-af98-7a059dd3364a", "value": "98304:7oCQHUwZaOXLHwV8Kv8aaTbM0UZQ21OA0zcsbAhc18eihtNfMJE:73fNOXbwV8XJbSQ7JbU9fMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666377, "uuid": "c8fc8c4c-dcf8-43bf-8e6a-dfeed5a7fc5d", "value": 13562880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666377, "uuid": "6c1d51e2-4415-431f-95a2-08bd60d9d648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666377, "uuid": "780baef8-91ce-439a-b544-e1d8a7769472", "value": "SecuriteInfo.com.Win64.MerlinAgent-A.28816271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32f56d7-e141-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766633354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766633354, "uuid": "11d0f895-c3a0-401a-a31b-ac1ce649ae02", "comment": "Malware payload", "value": "7c794b1a8f89ae0de8363e71f97884b2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766633354, "uuid": "a0a3d06f-96b4-46c4-8961-525db97f7a0f", "comment": "Malware payload", "value": "c33b723bec37bb942be0b3d50ae047e93e66bff86f11fa271c44c62bc7d82081", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766633354, "uuid": "750a3ea1-526d-43d6-ae1a-c3707969c83f", "comment": "Malware payload", "value": "e358ac0538ed4a08cba103911b5a971b2212452b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766633354, "uuid": "5334eb67-7a2b-468e-b4b5-bb62d34de631", "comment": "Malware payload", "value": "55d358ca91f1792ae6c0e8291eae0d94374a2d81950152a2530f6548d049de7f15a17bde5a02ab7dfebde34d1ffad6bc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766633354, "uuid": "28816d72-149e-49fa-831e-c9232535cb63", "value": "T18C669E03F2D540A6E0ABA278DF2683259B617C455BF496EF23503AC92F76AD07F38351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766633354, "uuid": "0640076f-d0bf-483a-ab06-d9588cc4633a", "value": "5bccab2e64261b713f8ac1abcfbe2578", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766633354, "uuid": "d213da6c-a3ca-46e1-b57c-591362a4127c", "value": "98304:LID0grFraD86x7tDhDMGIReZ32ovAU38nSvZ9ZW:L8laD86xBDYRo23/SvZ9ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766633354, "uuid": "7770271b-af4b-4801-8ff8-d7561d851870", "value": 6562208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766633354, "uuid": "30650f6d-ccee-416c-9133-c0431bc07511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766633354, "uuid": "a63fcfc1-e0e0-4bc8-bcba-bf555b4dbe26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7677e4-e12c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624136, "uuid": "6d729f79-dca0-486d-b130-9f3a22b7800d", "comment": "Malware payload (Mirai)", "value": "4223fcf2aa7e7a03ceaddd6bd01a206b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624136, "uuid": "bdc9a683-bc4b-4607-993d-30c1cd458d75", "comment": "Malware payload (Mirai)", "value": "c3c5917188e96e623db9af3452fed9c0339e633b7f4890edc1e954ae60ac2424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624136, "uuid": "eca15e64-e7a6-4179-a81b-93ad3fcd4120", "comment": "Malware payload (Mirai)", "value": "c46120019422c7bbb8d5497dfdc15601f7c78bfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624136, "uuid": "9f63d378-b4d5-436b-b4ec-1ad6edd10de2", "comment": "Malware payload (Mirai)", "value": "32953fc336c7570f065ab7190fe913fb9fc6d84892f38aa338b5ea68f2957afbb7feddfc871b07847f32d1307ab13c67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624136, "uuid": "4f1dd1bd-35e6-43d4-ac45-9777f035f06b", "value": "T1F4635CC99643E4F5EC2509715077F776AB32F5361029EAD3E7A5E632F822201F6063AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624136, "uuid": "4d2f5e0f-0ec8-4a63-b903-eca7fab02b10", "value": "1536:QFC2q7XY2YUMNx7fVRzLilJ6z2Oed0A7QOLmxyNbHr:QFM7I/pNxDVck2RGAkw6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624136, "uuid": "f2d8708f-2cfb-456c-bd37-cbbef0b079c7", "value": 71536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624136, "uuid": "8022dcc6-2e71-4d7c-a3d7-9cf43ede7535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624136, "uuid": "64560ac3-f066-48ea-8517-d626aec1a097", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf9a9eb-e1ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766693953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693953, "uuid": "472e759a-fc17-4554-a195-e4f63899fd7c", "comment": "Malware payload", "value": "77dda59c67531f238e26c66466de8cf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693953, "uuid": "3ad8adb8-1094-443a-b14c-f90fb1a1eca0", "comment": "Malware payload", "value": "c3ed2a612754f740a4653f0573f53c66364fdad535caa61ee37ca4948319c0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693953, "uuid": "92ee9f70-3c90-4fdd-b052-86cce2468fce", "comment": "Malware payload", "value": "9644faff3383b39ea261198b6fcf1bd9b7ad2de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693953, "uuid": "5fcd9acd-5d58-4a3b-b58c-2f42d3230ca0", "comment": "Malware payload", "value": "bf19ed242770eb8041d0656c08f697605aef0eb6c0ca5569982d01af1981f0164de52e22cc736379fe9f8f23f98e6e29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693953, "uuid": "30248b28-cf30-4048-a054-f90926e20fb7", "value": "T123D2E11467F50BECF2EA06F01A16C65A6D57787487B0C76C0C2120EF3964451EDE8B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693953, "uuid": "44efcd62-b3b2-4a81-95c4-36efc5795da2", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693953, "uuid": "e047781d-d76e-4813-82d9-77de2911e7d3", "value": "768:QLgoCUoNkomWuC4a7+9CamhL70zvLuM1LZRMbhps+l:QLgo8mWVCslczvrZRKp1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766693953, "uuid": "6489ed11-268b-4e4a-af3b-b32e7c24d0d5", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766693953, "uuid": "04fc60e0-f91f-4531-9022-57e44b3f9848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693953, "uuid": "eeebb192-d802-43ac-8fcf-14dff411400a", "value": "SecuriteInfo.com.FileRepMalware.76971985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176b085f-e12d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766624423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624423, "uuid": "c0b9e7f9-6c5e-4b13-91c3-b86c493e2716", "comment": "Malware payload (Mirai)", "value": "00defb91cd19118a87c406ec84eb8db7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624423, "uuid": "50e1e920-911c-4815-9f95-95b9188adcbe", "comment": "Malware payload (Mirai)", "value": "c437b3ebe72cd0ec30b6adc633a002b1203d94eb95bc4e452ecaa4af4d0f2f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624423, "uuid": "81154333-d3ab-49d2-b27a-2b1b57810858", "comment": "Malware payload (Mirai)", "value": "626d892ced0b3b601f5293c649b4b2005693d7b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766624423, "uuid": "f3c50024-963f-495b-a5ad-64456ccfa9d2", "comment": "Malware payload (Mirai)", "value": "af02c86d3d3b53887105455138c5330070368b290bb3f34dbc6c752f95a35799fff687ca68894a63fa5903a5447421d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624423, "uuid": "7c34324f-5a37-4b08-82e0-b36d89eceab0", "value": "T175834CC6E400DDBDF80AD67B84570F04B6B4B7D15F920F26A6B6FDA3B9310984D1AD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624423, "uuid": "b7190de7-ffe9-444a-a12f-0a98ab1d3a69", "value": "1536:CBeNAPh3J63mEWGSLl/eS9Gjgqz8QZOKv9kXhcFl/knVVCAy5:CBeNgBEQl/eS+xO9XhKl/kn3JG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766624423, "uuid": "7a649bfe-b567-4728-be0c-86c1336a9e0f", "value": 81164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766624423, "uuid": "41827468-ba2e-48af-ba05-326fdc260302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766624423, "uuid": "a128f333-92b8-4098-9704-7b7a39794ce8", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee25542-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766665586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665586, "uuid": "7e7f1bae-1ad1-46ab-ae7f-75b12c456d20", "comment": "Malware payload (AdaptixC2)", "value": "b99e63930e606f3be6fe9d91549c3189", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665586, "uuid": "7ccbee77-3b33-4abe-adad-ff7e23db0dcb", "comment": "Malware payload (AdaptixC2)", "value": "c4780e33d7ab1bcd6304daede805b5ae0270c4aa8cea8823467e22697dd2f39b", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665586, "uuid": "e1d8f910-9b2f-4108-893e-01710a06c54b", "comment": "Malware payload (AdaptixC2)", "value": "f640f35698716d1cee1ca34f0cf22658a4c3a52f", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665586, "uuid": "4d311c8c-d0fd-4653-8acb-a35d9429c139", "comment": "Malware payload (AdaptixC2)", "value": "572203a58e80cd22e7b70704c145536b90a4816f681bdc903d4132bfaeab2ab4220e3c7f3dd8c05e5bfd68e84a14858c", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665586, "uuid": "c1625a92-566e-43f8-8bf5-bd7cf9cca27e", "value": "T136733136E6A3D45DC05B8278BF83D4B3B8F07C681230651957C1A6223B6FD7C6BBA581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665586, "uuid": "56131c9f-4cc5-41ed-aa17-f46b45359f9d", "value": "c5a1172a47266df3310f72db2712caa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665586, "uuid": "c98f3469-7b80-44aa-b2ff-2ed45fee8bdc", "value": "1536:121H0vJWP1hiay2Da7sx5xjKJtthHkGQt7JO:K+NalCsBWthHkPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665586, "uuid": "5d38e0a9-5b50-425c-9783-2ec3ceb457de", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665586, "uuid": "94e465a1-0757-4d7c-a508-5974677bbc36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665586, "uuid": "e39d502c-1ec2-4988-b9ad-3bef1b2a8373", "value": "nodejs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d212a9be-e18d-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1766665967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665967, "uuid": "dcd961c2-bf33-4bac-8e4b-390380ef048d", "comment": "Malware payload (Amadey)", "value": "d9364eaf2a9bddb813bff9a1caba6d8f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665967, "uuid": "2a726b1b-17ac-4317-a899-9e64446d71ec", "comment": "Malware payload (Amadey)", "value": "c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665967, "uuid": "5862832e-4604-49a8-814d-8a23de4670e6", "comment": "Malware payload (Amadey)", "value": "dbe0861ef15875ef0f80e7dbf1eb1baca6b69bdb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665967, "uuid": "0063a295-b81c-43c6-8469-30b32ecacecb", "comment": "Malware payload (Amadey)", "value": "e51887dc3ccdee2c98a151ec4352c862be82f003720beafa7f19fab16b5f3301cef06f00b7d4b11370071dd9b0232707", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665967, "uuid": "fa37334e-25ac-41e8-a370-087e2fed6a79", "value": "T1B6F25BAE07D401FCC9AAC5B5D8B63A03D3B1B0475EB1568F0171C5DA9F02AD3AD2D789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665967, "uuid": "42a077ca-85b6-4471-ae20-6404fe3c8d0f", "value": "8068d82e2993f851a750aba84fc72ca9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665967, "uuid": "b498a6c7-5b76-48a3-866c-9358b663eaa8", "value": "768:anNlAP5jHPTjiBwEYkg3baAezJ3Va0H6LgYjWqWsl1/heIs:+45jvKBxKq3/HqWsl185", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665967, "uuid": "8773a88e-ccc3-49ca-86ed-02e8893259b0", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665967, "uuid": "4b9824a0-4994-46dc-b749-4d63cbd70d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665967, "uuid": "7abbd10f-8888-4dca-aae4-89c38b4e43e9", "value": "d9364eaf2a9bddb813bff9a1caba6d8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542d536b-e15b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766644281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644281, "uuid": "a85d665e-e801-4749-852a-5fd06f903ce7", "comment": "Malware payload (Mirai)", "value": "6d81d76b1875bde8ab36ec27c80ea76e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644281, "uuid": "2defc2b5-fa42-4aea-9c1a-16c28354d814", "comment": "Malware payload (Mirai)", "value": "c5a3f722c988d1ca91b77eafc11d5bcf77c3a7b2b8c6f2e2bbf1f81d1ca5590f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644281, "uuid": "a89c3330-8502-47f7-87e2-9ce5724fe2c7", "comment": "Malware payload (Mirai)", "value": "a0dd1640d47edbad153207a09c2d4c7b353cbfec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644281, "uuid": "5c59f7b2-eb96-4f29-838f-793481e656c5", "comment": "Malware payload (Mirai)", "value": "35576120551d6053339a526ff74d37a94869abe9cdac7559601859d3e3380f2cb4cbace3398d01cc233152c33d5507e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644281, "uuid": "97036a03-49d7-43a7-894e-9f28186f0df0", "value": "T168335CCA9A43D5F1EC15057110ABA7739B33E93610B9EBDBE790993AFD13601B20639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644281, "uuid": "2c62ddc7-7345-40ad-8af2-8d4509830c63", "value": "768:imO8+e0hzlRQXQxg6NyyWA16G8pQuoA4I8RQMu2ExJZvvfd+n9VrCx:ir87WzlRQf6UDpoAt86MuVx39aVr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766644281, "uuid": "7c3f09d0-eaf8-462e-b8b8-082c50c1e642", "value": 54192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766644281, "uuid": "e6e19007-2f8f-402e-95e8-8ae99efe96db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644281, "uuid": "55b2e964-8792-487c-912e-d46d7f0a7bdd", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aebf510-e1c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766688182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688182, "uuid": "e6b08cbd-4ced-4e82-bc25-0431c6a0c0d0", "comment": "Malware payload (Mirai)", "value": "32c86bd7d10c9b2a10d14491e61315f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688182, "uuid": "8f00b571-41f6-4381-a2c1-ba3dc7121ec6", "comment": "Malware payload (Mirai)", "value": "c5bf65bd9221aa0dae3c7ccace12c19525bb71688057e1eed65b334ae29f8b29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688182, "uuid": "876ad5c3-0586-4307-b4b4-8a7b959fda45", "comment": "Malware payload (Mirai)", "value": "35ea52d31a846e734772cc49326a178a82e3147d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688182, "uuid": "51bd4b40-10ec-4d4a-94dc-d460617d71a8", "comment": "Malware payload (Mirai)", "value": "e5816ed8693e816ccae7804dd3c4e5ef357f0c73d5c675ef55adec3d0889b7e9a518f53f037fd03a7c2d474bcb9f46b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688182, "uuid": "26a7473d-c542-4cdb-b21c-f33155d05dc4", "value": "T15F633A5B745481FDC448C27C0B69B03AE436B4BE56BDB2FA67E8FB056E86E105D6C808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688182, "uuid": "dde65045-e73c-4a02-af79-e7b80735ce7a", "value": "1536:hZ4SV6RdsxMv8YgYGHzws5F3/pHxGFtA9IITKfMCOGwyiZyHkXb80u5JGwD8N2QO:d6R+xMv8YgYGHzws5F3/pHxGFtA9IITW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688182, "uuid": "9b3cdbd7-bde0-4013-b39c-04e48ee1f3b5", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688182, "uuid": "3b5cf0cc-55ae-470b-89fe-17cb5b068607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688182, "uuid": "2b0282eb-f7cc-4ff6-81f8-c3ba70c519b3", "value": "shadow.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c161d431-e1d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766696434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766696434, "uuid": "3474f1a3-d29c-4aca-8429-55e6e3f33ca2", "comment": "Malware payload", "value": "1a1deeb495c30dc90179ca64aa3b0eec", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766696434, "uuid": "51301934-c289-4ccc-9012-352e2966b434", "comment": "Malware payload", "value": "c6e960401b9adbef4e1c12f8338ed098f7dd0718ffaa7063f2d394386960f9c8", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766696434, "uuid": "821a622a-252d-4f92-8b07-dcc22cf77139", "comment": "Malware payload", "value": "e7e7b23e326f9cdb0b65c54dcb76dca898fbc093", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766696434, "uuid": "295a5de2-fef7-4535-ac76-29a8ba2c6576", "comment": "Malware payload", "value": "c91bbbd20b9237ec61eb517a674d7946cfe8f1c54fc6d4ef64aedceaf84075f0073e08cf3194974c97e571ed1945d4b5", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766696434, "uuid": "391bba34-5a0a-4e8b-b8eb-bd4ceebc1bcb", "value": "T14FE7126A543DE84E19A460E6BDD1CE8906F647E8FA7CB79100AF8C1C60124B7B8F7D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766696434, "uuid": "1abd3215-203a-4cc3-ab72-76efa5589ccf", "value": "49152:Tupupupupupupupupupupupupupupupupupupupupupupupupupupupupupupupl:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766696434, "uuid": "9903e04a-a687-48ff-89e7-4d872e028082", "value": 68807277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766696434, "uuid": "627a4781-203a-4f1b-b265-b25d9c60a541", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766696434, "uuid": "2f4abe30-301c-4fc9-990b-15dc4194d52d", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2edb81-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1766665582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665582, "uuid": "283aa216-42fc-4c0b-a246-dd0a901e5530", "comment": "Malware payload (DCRat)", "value": "6f00a637e471650b1afc93f21bd6a050", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665582, "uuid": "a7ac51f2-cc65-4ac2-9c9a-ae91b2d6f740", "comment": "Malware payload (DCRat)", "value": "c7ae3ef1f6321bbee623fc191d7708ed7d4208537ac76fffc925c997be3064fe", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665582, "uuid": "128faf5a-e7b6-4f5c-9c97-a67e381107cb", "comment": "Malware payload (DCRat)", "value": "e242b871df8cbda146d657a6efd2696e2f477458", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665582, "uuid": "7b765590-f85a-4d15-adba-7c2b7e8ca747", "comment": "Malware payload (DCRat)", "value": "73756f94b5d4f67e1f81fce5f494a407cb110dab57075f818c261c32a9c9e1f7108a478c5fe3481af2a11435e1a003f0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665582, "uuid": "ff69b8bf-d612-4a36-ad5b-734fcb19a3b8", "value": "T16D6601037E948911E01A1E33C2BF47144774AD106AA6E7177AB9376DD8F13E27C19ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665582, "uuid": "2c731ab3-d0af-4e71-8ea6-028f06d88ab9", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665582, "uuid": "a02fcdb0-1b37-4d32-a759-3e434dae26fb", "value": "196608:gHUqET1xMUrsyB4+sk2US34oXBQxrRmYrFvgw:wUqET1xLw+sk2US34e0rgUFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665582, "uuid": "ee82ee91-4c03-4e17-b21b-f5b79661ec02", "value": 7000576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665582, "uuid": "6279b47c-5228-4522-9d88-8a5748325a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665582, "uuid": "0dacba93-a614-4ad2-8eb5-e0a773f6f8ca", "value": "6f00a637e471650b1afc93f21bd6a050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7923d32-e1be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766687022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687022, "uuid": "f5f9c925-028e-4570-8b25-ea95db2de2c0", "comment": "Malware payload (Mirai)", "value": "4c88b931150bc24d35af561a3ada8d0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687022, "uuid": "f82c0347-6eab-49dc-b4d2-02a0e79cfa0d", "comment": "Malware payload (Mirai)", "value": "c8922e9a30b6aa7b5aaa34f7c89a77d349eed01e9b6bcfaea9792902f8bbb100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687022, "uuid": "19100663-8372-4d37-bf08-86069bd352a1", "comment": "Malware payload (Mirai)", "value": "9b2fa348a1f1e157284b7918f24d54fdb97a7fc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687022, "uuid": "f91231f4-4b1c-451d-9c8f-a95b1db1e6e2", "comment": "Malware payload (Mirai)", "value": "c1b53dacc6e899e10db2c1f8034b0be9ee887c7e10284c864317da5cf38cd9ab91e51fe2561666190d697ef95120038f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687022, "uuid": "0fac7b9a-d83e-4dba-ae0f-b44f8c1f1127", "value": "T194935A0277180E43E1A25AF42A3F17E0D3FEE5A021F4FA89650EEB464175E365586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687022, "uuid": "9c308bca-0d53-4fe6-9268-ab8e5cd7a563", "value": "1536:vhozCFG2JTjCfRK9WqNRNO8FywrosKcgAYP2HbiYWXyz6jiMEiTmqcR2:5oztU9Fk5cwKX8iViC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766687022, "uuid": "9396e51e-ae14-4d26-bfea-e2e3f1c592ec", "value": 91548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766687022, "uuid": "0e3a7a00-7c70-477b-aebc-d5e8490d8e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687022, "uuid": "c1014cab-1c66-4d73-91bc-b071898d607a", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063bf3da-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665196, "uuid": "67284ed6-f90b-484d-9c77-5fd639a701b5", "comment": "Malware payload (Mirai)", "value": "b469d4fe7c2b0c362e207980b83279c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665196, "uuid": "382fdd49-d862-4416-9f59-b497054f2443", "comment": "Malware payload (Mirai)", "value": "c8c790e3c7e9f69a1172bcc0ee50ac5bf28ffe1af057f9d4dab453658dad389a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665196, "uuid": "c294c00b-ce9b-496f-b125-da34981aedb0", "comment": "Malware payload (Mirai)", "value": "008a8d746f3d617e4c3a34fc5f437e52252638ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665196, "uuid": "bcbea55d-1dc7-4b42-b685-35e4032a8698", "comment": "Malware payload (Mirai)", "value": "c0ef9ffc8100ec96b8c17d60d081f8e3ddacaeac5f703b0dde63342ac8917942528ea89e8dac4705d67691de27444b72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665196, "uuid": "88222579-bf74-4da6-9a7c-9598a0abc075", "value": "T11B532A55BCD18A2AC6D063BAFA6F426D3321A3ECD1DB3313DC245B107A8A51E0E77791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665196, "uuid": "6410d996-6fa3-45af-92a3-1537ddedabcb", "value": "1536:AA+jI/asm5gY/ULB9PCkXL6ouS1YSUrx2yBGIt5YKptGjryP:AA+jIiskFUjASqSi5JbYKptGjryP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665196, "uuid": "a4ec358e-71f0-4494-9d86-0bcff1317cd9", "value": 66575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665196, "uuid": "7b044de3-cc31-42bd-be08-d854d8fceea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665196, "uuid": "b9707858-f6ec-40cb-9ee2-767888ceecf1", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f271d8f0-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626079, "uuid": "04b1f337-44fb-4786-8ff7-510523387ec6", "comment": "Malware payload (Mirai)", "value": "8d6befaf3a51db87f3dc91b3c89795ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626079, "uuid": "e00a5d20-53ba-4b3a-a895-117f15210a32", "comment": "Malware payload (Mirai)", "value": "c946a4c84415428b2a73f7e9888c213a61fe9358cfea33a2d71444b35216728d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626079, "uuid": "165e03ab-8c58-4c53-829f-2ac8d46063f8", "comment": "Malware payload (Mirai)", "value": "f5b82ab36cdc85114a0b0cb6abbc825ecd9aa9f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626079, "uuid": "f40d4848-2630-4a71-99e1-f3bdce1a1f91", "comment": "Malware payload (Mirai)", "value": "6faff5903fb3f05c80d1c649edace5f8cd3aad03c46b699a0de98ddc65a7a30a02c3f2ae17cd840e6aba671c89bf5a20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626079, "uuid": "1e1c5221-1610-4846-b02e-1df8d0f87e7d", "value": "T122435B41B3080843F5631DF0793F3BE1E7DEDAA011B4B285795FAA8941B6E32550BEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626079, "uuid": "808b077d-b85e-4181-9511-0798d92a79fc", "value": "768:GmjE0yVN0fjo5W2GIY6on24Obn/Z0VD4me9l9wO7tUpUrYBx4zkiKTwnd:/6Lao5WHIm2ZDZb79gO7tUprx4oTwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626079, "uuid": "cf2c774a-fdda-44ec-a0c9-4e84d810d243", "value": 58868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626079, "uuid": "2169708a-1318-4a19-98a0-c5cae839fdf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626079, "uuid": "7a399506-6a17-4e77-9917-97f4791ffd35", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ad82b8-e1c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766688515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688515, "uuid": "ede6ef0c-126b-4390-aee6-639a4438ab2b", "comment": "Malware payload", "value": "d7ce75a91cc3bbe3cd193717e70e4570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688515, "uuid": "80e56a74-9b63-423f-b575-e048d229516d", "comment": "Malware payload", "value": "c9621264e9995e72e3493fb2224a4597dbd329b93d15153f9cffe0e5296f45da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688515, "uuid": "c3f05e9d-0e5b-4f13-8949-3161606cee94", "comment": "Malware payload", "value": "fb8165e0f4ad4e4ea17207b28ac501518a60292b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688515, "uuid": "0568e135-6621-42db-939c-860851408900", "comment": "Malware payload", "value": "f50c7225ad74df6eed2c5765cd02adf5068b2ba83f37fd842e15570a43dda505335ac4fc84ae56aa9dcce02d7beecb7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688515, "uuid": "2404db64-4ad6-436b-8de4-79498893dbca", "value": "T1919533E06072412FEE1CE0207C99D6DE34D687E266F9C1532E67221BD52FD16C4EB6E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688515, "uuid": "fe7ac352-ce9f-4659-8df8-99067a04af83", "value": "49152:aaSSuv2Pjvqiv4vFYvK94SGS53W1wamS1MEqTA5sA8/Vp2LO3:TuvsArOSGCDM1MEqSsA8/eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688515, "uuid": "c8f229df-3fbb-4732-a2f1-5bc2fee2fc9c", "value": 1889736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688515, "uuid": "a77efcb3-0ae0-4f59-9504-5482f35bb30a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688515, "uuid": "cc1cfe7f-9cea-4e4b-8439-b1f3679dc48e", "value": "app2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef65b45-e15f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766645910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645910, "uuid": "27fe9e48-1f06-4f05-89b6-16d9d20c1758", "comment": "Malware payload", "value": "b90c2cf3078f803fb7d6ae349282d264", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645910, "uuid": "2d852328-457a-4a8f-be17-66a70287f4e3", "comment": "Malware payload", "value": "c980b839ab0c510fe143c86d88e0a5edc6aa3119ab504920300b4ffb731c8850", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645910, "uuid": "c431e76b-5e56-41bc-8ebd-9ade7e87ad1d", "comment": "Malware payload", "value": "0e4ac4fd2c5c4916cc2606e2b449b4a7c9567b3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766645910, "uuid": "dfe800b1-2d1f-4774-a28a-04c92ed7efee", "comment": "Malware payload", "value": "c270e07c7b5704998055294aa629db39cfda6a8035a8efda5847424caebc0698e1c93bd31d25b4e0820cf706dba65b87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645910, "uuid": "77d1b97b-3dc7-4644-a92a-731a58ff107d", "value": "T129B423E61E4459D846ACA09F5BA8AC1D65DCF438CF379C4CCF8408C87A56F7AC09A2F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645910, "uuid": "90391283-ea49-4d72-933c-42b25e1a7f4f", "value": "12288:j+ajEJnjwVvPZ9YqLbWq6258q1ilZT8pTUUa6q+:yaOwVvvYm3CwpbTq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766645910, "uuid": "0cc711e7-00d8-4919-b690-3e1715f75733", "value": 507644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766645910, "uuid": "da6d58eb-ddb9-4a1f-b82f-70711d9678e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766645910, "uuid": "1cc9ab46-4e66-495d-87d0-5e116d73e593", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8601a857-e1be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766686885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686885, "uuid": "995f6a4f-43bf-4ecf-ac52-3d8dbe396d2a", "comment": "Malware payload", "value": "643bcb43d85e4317d34b5d057f866304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686885, "uuid": "7838b6b4-e2c6-452e-bbd1-62305d50fc9c", "comment": "Malware payload", "value": "c9cb8666e468bf003f46bb2f0b1057d050d1babc0f5377a0425c2c93e959811d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686885, "uuid": "40890cf9-ddcf-4904-b5f8-6192cb839ffa", "comment": "Malware payload", "value": "a2bbe2bd7671543408c39786196e3407ecb4df48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686885, "uuid": "b1a22888-b504-4267-bf86-f3df9fa3d10f", "comment": "Malware payload", "value": "be4055fd13e5891514f3effe2e52736100d9440af837a061d56cf45d8df0a298acaa4ef0d63e8bece68b4b59d6205488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686885, "uuid": "d75ec437-19ed-43eb-9f83-211c105ec141", "value": "T1E1178D03FC5559DAC2A4D0B589AF42967370F8002B3BA7DB1E10B7347DE66D9AE3A350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686885, "uuid": "fac89a9e-2b4b-439d-8d9a-08a6b42d0c20", "value": "0d6fa16cd7ab6bba327fd0e94575db7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686885, "uuid": "951219fe-feb3-4880-a431-7d689769f3cd", "value": "196608:9IU/Fpb9IyuH3tBp12J8voTmlUcae9jAUBniDpB8Ipu5basKS:9IU/FnGH3sVCiT1puJasN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766686885, "uuid": "62439834-39ad-4679-b0d6-32d2bb6ac22b", "value": 19944413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766686885, "uuid": "392651fb-1a1b-444a-a995-15aabcc1f72c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686885, "uuid": "b58e0301-819c-4040-a19f-3f5e33f85e77", "value": "leaker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d7ba54-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641491, "uuid": "d1946d2d-8dea-4795-a1ab-f95ba1e6639a", "comment": "Malware payload (Mirai)", "value": "0b85e1d07625c350b92ee016cb8b73bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641491, "uuid": "8c96543f-2cb8-4047-9813-fa1b956cd787", "comment": "Malware payload (Mirai)", "value": "caa022547a71203f366cde25bfda995da28c0306663cbabd41d38e2578e4bf49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641491, "uuid": "7214a0d8-990c-4b20-852f-539aa762173d", "comment": "Malware payload (Mirai)", "value": "5786b26ef2d20f775ed7d2d62054e5a09d45a94d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641491, "uuid": "42fa1c51-0104-4770-8864-f5a353160079", "comment": "Malware payload (Mirai)", "value": "31a4c1f5985a65171d0fb2525d1d3f744929eacdd4559addc784c7696dbcf6e3998ce62f7d0f1f4d47b893bbc35e2f1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641491, "uuid": "039ffe6a-d7bb-4fe1-ae59-05e0c566f69b", "value": "T1D0936C21B9792E2BC4D4F57B22F34364F2F1878E24A8CA1E7D610E4EFF2565022476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641491, "uuid": "ac40dbb7-6c7c-4132-a2c6-843035542b48", "value": "1536:rp14TXLAm4S4yeiL4PL/3tUTHd1KRvrtHjYl5z8vt0wHn:buHjGuHd1iRjYXgHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641491, "uuid": "57664d67-919b-4428-9b2c-fbb33b470099", "value": 96328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641491, "uuid": "8496b861-57d9-4d01-980a-f273bdcab37a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641491, "uuid": "845d6313-5524-43fa-98ae-a40e2ba29a15", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3504ad8b-e14d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766638216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766638216, "uuid": "dc68f995-86f6-4c7c-bf86-933b213dc3db", "comment": "Malware payload (CoinMiner)", "value": "7932487b546691115ba8be47290acd7e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766638216, "uuid": "38e33f83-006c-4e96-b554-821e4a6206b4", "comment": "Malware payload (CoinMiner)", "value": "cacbdcb31a8192e96b00a3279804fac237be6f86048c9fa428bf295fa9ee1fe9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766638216, "uuid": "85809191-d751-4179-9308-f66dd0835135", "comment": "Malware payload (CoinMiner)", "value": "664dd7cc41185d180a9f01a4e262975a71304a79", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766638216, "uuid": "84f613b3-c8e3-4bdf-a8b5-ff815edd4157", "comment": "Malware payload (CoinMiner)", "value": "feb2508eda7ecbcc967b45e48e53ea5b657b1475a23f8cbeb8ccf331a8ec4dd51851a5651098358be8df569321085ae1", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766638216, "uuid": "43560ab5-ff20-4eee-a65f-8237951a5a36", "value": "T1EFC5238BABF44675E4B8ABB8C8F587212B31BC912B6A47DF810405A995331D43F70BDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766638216, "uuid": "ad4c7026-42b3-4be6-a6d6-180b08eb401e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766638216, "uuid": "0883c92b-2e62-4cf8-9432-455a37a3fdee", "value": "49152:/ydjsVTcCZiCY8vp68Lxom6VmpWDTSq5t3vLwD3Q9jGWxzb1x:6dMT5eQp6Topq5t/0Eweb1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766638216, "uuid": "1db8551f-5a7c-4aa7-aec9-0f89b998b822", "value": 2697728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766638216, "uuid": "eca068a5-1a0d-4195-8b41-2632da4bfdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766638216, "uuid": "1c36ca65-1618-4c4b-88e3-90f7fcca68db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b379d3-e197-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766670076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670076, "uuid": "633a1dc1-bee4-45c9-af72-e45f068b5339", "comment": "Malware payload (Mirai)", "value": "21800d20b5421e343047d17b6c66294d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670076, "uuid": "73308787-2e71-4907-891b-472f0836433e", "comment": "Malware payload (Mirai)", "value": "cacc62ceb85bcd51d963ee3c23678aab3faf29579c1d6f4962b8f20c013e4716", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670076, "uuid": "48ca38a5-d0d4-4fbe-afae-719d024e4e88", "comment": "Malware payload (Mirai)", "value": "a4ed2314ea58fde6455f3be3edf225ea7d4ad6e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766670076, "uuid": "7fd434ee-9680-44b1-a51f-ceb8fc4ac409", "comment": "Malware payload (Mirai)", "value": "f9d4b6fe9c2c067f880787f3a175cd334b6c23f9690bbcc7495c73a2ab0ffbaf2aa749107105a07c3b6a3833dc9e4826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670076, "uuid": "54a09342-b56b-4507-91cb-8ca54159dd23", "value": "T14743F751BCA2866BC6D063BAFA6E518E336673E4C1DF3657CC104B017B8991F0E77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670076, "uuid": "0889c13e-be40-4de9-9036-2ecea8a96d17", "value": "768:jdxJNJamE+rU9NZ0BfVBSXhpfDhdel573cjMsc/GSVQd1A5VIqyue2mKNoj7lBNl:LMR+Y9NEVAXvDhkl/Z2d1A5V6u+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766670076, "uuid": "627f1c17-45c8-4d08-a0e3-5a0e30c32973", "value": 60384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766670076, "uuid": "32274b0c-6d42-4364-bf8b-4d29500b6374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766670076, "uuid": "46bc6c85-2c6f-48f6-8998-4c7ea96b7cd9", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e346733-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690335, "uuid": "b4263763-6487-4783-8599-7a517f102436", "comment": "Malware payload (Mirai)", "value": "af101253c384a312845ce430aa860fc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690335, "uuid": "5e55b8c9-e15a-4ce1-9cd7-4b8e12c33325", "comment": "Malware payload (Mirai)", "value": "cadf82600085db2bd650c43d6323f2383f7696805a7cd26a2744f2f01743c8b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690335, "uuid": "4c4b1cff-0d53-4ef1-ab03-c055e3cfac1a", "comment": "Malware payload (Mirai)", "value": "59ff7f6c8e10a7ba0a7d174d28fe425a66954621", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690335, "uuid": "66606f21-11c1-4d70-9716-b98490ed6ce8", "comment": "Malware payload (Mirai)", "value": "56648649b4f1dc23d819398608d047c184c04f93448f52ebbc0d36bfb05a924b525a5371c8d7e73bbf2718f5f3fa60f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690335, "uuid": "d4606b44-e9d8-46a1-a800-8fb8880684a9", "value": "T1DA11B9CF31911FF148089E0CF9770428558785D8FE626EA857871C3A4CDB72C7938EA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690335, "uuid": "84a72831-e6ac-4946-9463-8e00dc04da34", "value": "12:oMywWW5hbUWWflaWW29NIl5MWWQCa0LKVWW1NgO0WWjJibWWZO7ZWWWSvUWW9Nt4:TulbNI7mKUzi8WAMNt0HO0PDf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690335, "uuid": "17ff0dc2-f599-4749-ac5e-776606a14d9b", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690335, "uuid": "866c45bc-675e-4508-86c2-23f8c47c2d9d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690335, "uuid": "b042bf81-48ec-462c-bb71-c276e801fea7", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1cf852-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626073, "uuid": "3c7045c2-6437-4d4d-8d69-8400ab427cd9", "comment": "Malware payload (Mirai)", "value": "39cdb0a90cf98eb16a0c9c114d58a64f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626073, "uuid": "9ec96799-0659-4c0a-8524-f12b402a42c4", "comment": "Malware payload (Mirai)", "value": "cae2a6662afa818ad96d55f1885936cf3b6bf65cde8e5de1329c02ae44bfe21a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626073, "uuid": "966c47d4-42dc-4295-963e-5b43fad155b0", "comment": "Malware payload (Mirai)", "value": "d36d40a253e95ef20c8f1eeaaa2f487238e5616e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626073, "uuid": "5d73c564-e5ad-41f2-9928-d073a63f15e1", "comment": "Malware payload (Mirai)", "value": "dbb95cb8ef1791578d1c549e6a30b94014e62242c0b4a33362006a42913ecfdaaad9345b3c481c42b64ce339d9db47a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626073, "uuid": "ddd170bb-7be7-4c0c-b56b-6d3d8f519010", "value": "T1B092E0B51B071D07C59A1A7A310F04896D2B18440F9E47F7BA3D4B0A1E43DFC813E6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626073, "uuid": "296e64e2-0695-4ec7-b33d-b9964a860291", "value": "384:M85Lzj0CwfYQgSS3hBni80Ot8O81LLzuyjcCTON6dGrXtB405f0Kgpr+v1R8M6:xLX1QWPJ0OtgBuCSEduB48Eq8M6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626073, "uuid": "fd6417a7-3037-4995-a1a2-147b7a2edb71", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626073, "uuid": "c9469496-ff78-4427-9f1a-5b220353c46c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626073, "uuid": "1e68772c-2fb5-47ad-8a93-b65b7ff48335", "value": "0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b9b934-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626111, "uuid": "1611182a-23f3-4671-9052-1b5f6390e5de", "comment": "Malware payload (Mirai)", "value": "1f71e3ff4b271f58a78e71c2b26c53c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626111, "uuid": "92e32adf-2066-474f-8408-fec20ab07865", "comment": "Malware payload (Mirai)", "value": "cb1c4ec5e6928f50de1894389fa2ee010506239f1682806998bf1584ef58913a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626111, "uuid": "fdc63796-8309-4842-aa6d-b9c6934a3bc2", "comment": "Malware payload (Mirai)", "value": "d7b6bd526e60298a3962ea097eebdc7adbe27ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626111, "uuid": "fa6c5341-79ac-4a75-8be1-c75da2b59289", "comment": "Malware payload (Mirai)", "value": "a33b9afc96a8ab4e04da0d4ac3be0def8f17771fa8542d4e303ae1b855d64ea849f07d28f074b9c1207a35307836296c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626111, "uuid": "16a305c2-5c5a-4dd8-a38f-52b28aabc39c", "value": "T11263F956F8818E26C4D5027EF92D118E371267E9E3DFB2229E205F203BC652B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626111, "uuid": "e4476fd2-0780-4ed5-8e1b-38ef2427e82f", "value": "1536:6tnFAcax7yvTwjfoKzaQdzHKOSRus+DcDaIPihfmR0LMO:gi7YTGoAlBmufmR0LMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626111, "uuid": "b09eba2d-ef89-4c05-913b-f59966edc0e6", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626111, "uuid": "95b00057-9650-4f77-916b-0edd6442ce2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626111, "uuid": "64b500b1-b936-4654-becd-89c20d87932d", "value": "0.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8791a3d-e17e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766659482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659482, "uuid": "c256b402-ea57-46ab-b5e0-8396d9290d5a", "comment": "Malware payload", "value": "ccfe968b39f27a6dbd9d412ce9a0c13a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659482, "uuid": "e85f6952-0fee-493b-a894-5ef008641cc8", "comment": "Malware payload", "value": "cb8b1717f6179dc1dec5b1e232570d700c8a557a2347158de18bb2e160342d4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659482, "uuid": "083193a9-377f-4369-9229-2ce050e98ff4", "comment": "Malware payload", "value": "0d36a4b7512c986125d02c871c8b764ac0fef4fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659482, "uuid": "4c9769b4-365f-424a-b4c7-7a9e14ab3c02", "comment": "Malware payload", "value": "e5ec6f453fe872c97ed1de48c03a2c4fa4a32b395202813f31f753c1f6f64051c4a22af1a84ad475de73c309b380af53", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659482, "uuid": "fc5f1a67-a19d-495a-bc3b-170f651e3ebc", "value": "T1D62150DE3CA87234694FF9C4301D55087A8BCFD5B036CB18658C44B2AA85D25FF66F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659482, "uuid": "81bd5fa7-5804-4724-9f72-c68128c9d428", "value": "24:qxKsKyNNIG07KbKpKR5Kn+F7KwNfm7KAKIlKe0KGgKYHA:snKAqwNb8xvll0E1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766659482, "uuid": "3cf433c5-4bcb-4f7e-8742-0a6df9153375", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766659482, "uuid": "28a23c16-f8a5-4136-8d8d-d06309303165", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659482, "uuid": "0f28c9b9-4edf-4bd0-a447-fff43bf92d1d", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc51b9e-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1766694037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694037, "uuid": "ce7e80fc-8d07-4138-bbd8-93861e70dbc4", "comment": "Malware payload (Adware.Neoreklami)", "value": "75ac66217fab820b521106a63cef8445", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694037, "uuid": "8eb70b99-d861-454e-bfaa-31d5876546d4", "comment": "Malware payload (Adware.Neoreklami)", "value": "cc9bbdec4c55ecbdf47fb45e7386f500460edb29f477e11140dd35999098aab4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694037, "uuid": "2eb60199-1869-4aeb-930a-fdb63ffa300c", "comment": "Malware payload (Adware.Neoreklami)", "value": "5f94b58a666358336018ceaff8539cdbfece992b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694037, "uuid": "21c5754e-a117-4a94-ac33-1b3d498b73f6", "comment": "Malware payload (Adware.Neoreklami)", "value": "977cea247d1fd80bdf6985e76e118573d1d6d664bd13181946d0c55dbe0a13b4dc122152ba13d93605a343b830a4b489", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694037, "uuid": "1ee1a310-0bcf-4c97-81f1-450344725367", "value": "T1A876331032F786BAE2931672453C3BD3EEB2D7A41732A6B337910A3CAB5D1C9940B55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694037, "uuid": "ff60fbef-333d-4300-b33d-5737931085b2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694037, "uuid": "bb154c96-16d3-45e7-a6ec-b6f03391be14", "value": "196608:P1OrKoqjWQZvLYHIRdu7oN/WAaqA29SJG12sHgkA5lk:tOrKvtEoCMZWzq3IJG1BAkA56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694037, "uuid": "7851db5e-dfca-41e2-b20b-94b43af73d38", "value": 7560696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694037, "uuid": "d3648470-f65a-4d53-b176-a7c2702bb504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694037, "uuid": "d48d562c-f589-48c7-9cb3-aec69351bc3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba09351-e1ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766693954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693954, "uuid": "e095c48e-159c-4a77-a17b-90e1b45d7d58", "comment": "Malware payload", "value": "97e27ea3cfdbceb6de59380dc812f900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693954, "uuid": "821857f5-58ba-4621-b873-f0eb3ca2acb9", "comment": "Malware payload", "value": "cce278f0b8b19cfc25545b9b2e126d0f7580d38234b2ecae79c7f32d92f9fcb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693954, "uuid": "80167caa-b014-445c-a658-bd4643fda2d7", "comment": "Malware payload", "value": "c727c36be1639021cf242b61cf35dfa78094d597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693954, "uuid": "64757fc7-8ddd-42da-928f-f99285adb5b3", "comment": "Malware payload", "value": "c3500146204f5383a1c6407bd65bc75ad4a98a1b6f014d81b1365b713aa8fffc5739c460b8603aa59938b77c9c3a7c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693954, "uuid": "50c87973-8719-47fa-b5d3-0dba90048e20", "value": "T1D3D2E10467F50BECF2EA07F01A16C65A7D5BB8A487B0D76C0C6110EF3D64451DCE8A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693954, "uuid": "29692a37-13de-4f41-aee0-c4957eee7f03", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693954, "uuid": "029445c9-6de4-4cdc-ae3e-1090071aa8a7", "value": "768:ALgoCUoNkomWuC4a7+9CamhL70zvLuM1LZRMbDs+F:ALgo8mWVCslczvrZRu1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766693954, "uuid": "e17c5435-b61e-435d-a2f6-4cc5a707a168", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766693954, "uuid": "15c1f45f-a47a-46a8-962c-0b4227ed5d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693954, "uuid": "55068801-fbfd-4d64-a1fc-bfa5a19314d5", "value": "SecuriteInfo.com.FileRepMalware.51353619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b399d5-e133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626963, "uuid": "956aaa2d-8311-410e-9f54-e65d62c3d568", "comment": "Malware payload (Mirai)", "value": "99bf739dcf88cd38eacb7a18067cabe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626963, "uuid": "791849c3-4edb-4cd8-90c2-a5f3922d14dd", "comment": "Malware payload (Mirai)", "value": "cd77215ddcec0dc7e6edba44b8f8b17e0e4ef1d2b5582463e67c116bfbbab5fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626963, "uuid": "4536a5bc-9000-4fdf-862f-021031056d68", "comment": "Malware payload (Mirai)", "value": "0d23364d3473e7e599e39cab8db9188df610918c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626963, "uuid": "4a50a5b1-bc23-4394-b1a1-1301b789a3cd", "comment": "Malware payload (Mirai)", "value": "b1822c74c294713176dba8e961ed8839c1e2f2e5f86c1f4d904d6f7d1c7e1935115177ee0748fcb1f4d6f9106f947659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626963, "uuid": "d73e2c15-12dc-46d8-b8d9-d31324a4f03d", "value": "T1AF73C649BBA14EBBD82FCD3705BD1A4525DC924732A83B393A74D428B25A18F4DD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626963, "uuid": "a6951c3b-a2a8-4aa1-a024-db44dc22d22e", "value": "1536:aQPlYRJnBTXU/21/mM5B38hugRLJNtxI/ZYEMok2gDTwe:aOYR7TYzkG/2oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626963, "uuid": "e46cbc40-b99d-41a0-816d-463b3bb48d19", "value": 76580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626963, "uuid": "f737bb9c-6768-4ea0-a565-309b6bdeb093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626963, "uuid": "34d99d95-47d7-406d-aa24-87fd2c56169b", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc62f85-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666628, "uuid": "5560f7dc-584f-4bf3-afb7-555179d41b2f", "comment": "Malware payload", "value": "a5fb7d7c8f239bfbb1bf7320ef29f4ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666628, "uuid": "d4b34d23-9dc7-4a9d-8da0-d7b09415f852", "comment": "Malware payload", "value": "ce5686bbb9237dab398663fd30c7b339bf7115e288de5ae4a07b137d393da629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666628, "uuid": "5d255c64-9ea3-437e-90b8-4baaadcfa514", "comment": "Malware payload", "value": "ab5ef29e72efc6f27ae6a1f13dd899cb272e077a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666628, "uuid": "3be81fbe-44ae-4753-b8b9-0e4ddf97ee17", "comment": "Malware payload", "value": "44bc5fe77808c0b2101f9ff05596d4fa704df2e8c22021bf1a30ecfd332659a4b784827c5a59e20a164224b889c3cea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666628, "uuid": "817ed589-42e6-4dd6-9c48-c5fcc81e2095", "value": "T1F0C6A9978C3C09DDC597F6B98306E6701DD2A9AAF5F2E0E669E00550AF827406FB1F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666628, "uuid": "722e9b5b-e324-4a45-923d-27cc6dc0dd1b", "value": "49152:vvN37xlZuwNHclGPNvJgmG+Tw3zCEGsQA2KlFaldnftAELWlGNYphNA5fY2Vn2k+:xThn1PUwp/tyc9X2EALV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666628, "uuid": "883296e9-79ca-44d9-b338-8f2e40804145", "value": 12300000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666628, "uuid": "ce9142e8-66cb-4bb4-b25b-bf2b35669faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666628, "uuid": "b9149052-3436-4710-b515-e2102443e59f", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9fe7e8-e16c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766651788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651788, "uuid": "688b0223-0a0e-479e-825b-0696544115e7", "comment": "Malware payload (AsyncRAT)", "value": "836c2f57076a8027cad51c4fb14a7088", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651788, "uuid": "22868d30-b9fa-41b5-9a36-17bf01d964f2", "comment": "Malware payload (AsyncRAT)", "value": "ce79aba649f0300718d55ecdc9d9f3b6be82c656b2a76dc38924d932391bce89", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651788, "uuid": "8a4fa5d3-36b2-4323-884b-d979cd076ed1", "comment": "Malware payload (AsyncRAT)", "value": "a2c0a8af0f784a37e93ad2dea0156933429f0c77", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766651788, "uuid": "d0890666-f1fe-422c-8b4a-4d56265ca731", "comment": "Malware payload (AsyncRAT)", "value": "51933896df321267d45f2c0d54b97bc494e3075a2a9cdc7414aeee30d7ed69133cd80ea46f4a7a218b0e94e252365db1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651788, "uuid": "62c40a21-6a02-48f3-85f5-27d0dd87ef8d", "value": "T1BB232B003BE8822AF2BE5F74ADF26145467AF6637603D98D1CC4419B1713BC6DA426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651788, "uuid": "1bfc9e54-7ea5-4248-a9a2-3ff81b0cfeb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651788, "uuid": "e648c04c-5f6e-46ba-b35c-73bbc8518511", "value": "768:RuntVTRst9nWUbUNlmo2q9IKAB6Q6TXwraPIwzjb3gX3i12kgRiQoJoHFsJBDZfM:RuntVTR602CA/w3bQXS12kkiQoCWXdfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766651788, "uuid": "07b5af99-c3f6-4ffd-884e-831b4566313e", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766651788, "uuid": "bdb61bc0-7816-417b-a9a7-00ddb29c7a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766651788, "uuid": "bad752f8-62f1-4e3d-ab22-bdb75a7862a0", "value": "VertexGuardianPro_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2702fc0-e1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1766702958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702958, "uuid": "e6e6586f-d4da-4de8-9521-9ba2e0a53de1", "comment": "Malware payload (GCleaner)", "value": "faebf99fcf44f223214717256eaeab4e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702958, "uuid": "d9447cfd-3cd2-4f23-8cbc-f106167b9a93", "comment": "Malware payload (GCleaner)", "value": "cf173d70cc6a9c9ebea6785cb37dc8f9485ed46a5bbead496ca2b6a0a2872a4f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702958, "uuid": "82ec2231-f1a7-4201-b729-d359e9b1fdfb", "comment": "Malware payload (GCleaner)", "value": "fad1a5d4ef7e6f62ca9bab2667087a0083f4f7f7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766702958, "uuid": "8cf82b83-6485-49e5-98e9-9d80cb861035", "comment": "Malware payload (GCleaner)", "value": "c9535ff33a2cd1e2d553b5ed6803e7e829c10e563c5c10780d7bf20f7fa2134b31e13b92890d4eab1aec9d77d9e21caa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702958, "uuid": "e01ce947-35f4-4d8e-b840-7caa418f9d0a", "value": "T12126E045E96002EAE1FA05FE8D57026C7C1CE8B3DC649F3AF5D9C59612B9683710BAC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702958, "uuid": "c1c4d6e9-730d-4e68-9955-28cb359edcf0", "value": "d9602d58db63e796034d7dc7a7754fb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702958, "uuid": "7c32401c-a26b-4485-aa66-833edaa10a09", "value": "98304:/S2b7M34L1sb6X2QK1VdYs+QNZNQ0tYq5bwvFEAJzrZket:/ZXM12XQ1VdYsTvZYKbwvFE0zSet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766702958, "uuid": "648b815f-9099-4a91-b9ce-d65c5054b54a", "value": 4737808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766702958, "uuid": "0207e48e-982c-4967-aaa0-2a02910792e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766702958, "uuid": "8b467812-817a-409e-8fc2-81035127f6b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46f8ddf-e1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766705431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705431, "uuid": "a6f15226-e1f1-4a15-a9c0-4e237cb8e904", "comment": "Malware payload (AgentTesla)", "value": "a2eef5aea3b07e5587f4afd98f2b6ab4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705431, "uuid": "acf64818-945e-4862-ba49-be7be2f4df18", "comment": "Malware payload (AgentTesla)", "value": "cf9d3ba6a9a8771d398902e71e90000752e25c4dbe9aa86ad3c6f29a7d5c843d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705431, "uuid": "63718f52-283f-475f-ba52-ee3d13a56b4f", "comment": "Malware payload (AgentTesla)", "value": "c2209bd8a27a6655682bc63dcf6be529d41e26a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705431, "uuid": "02f53fb3-bd81-45ab-b842-757864e312cd", "comment": "Malware payload (AgentTesla)", "value": "c4e4c52d50680871688743c94c1640f293b1882f3eeb9de57d21c0393655804df13366f0d33c8a7108560c1fe42b9027", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705431, "uuid": "f21e6766-6e28-4ba9-8957-34184ddd029f", "value": "T10735BF0273C1C066FFAB92334F5AF6115ABC79260123A62F13981D7ABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705431, "uuid": "f014fa8e-c6d9-4ece-91fe-f95f569940f5", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705431, "uuid": "7551130b-c3fa-4c2e-bcc3-6ad75138238d", "value": "24576:35EmXFtKaL4/oFe5T9yyXYfP1MAXDzBmBXaJaAZ3WJe:3PVt/LZeJbInGizBXoAZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705431, "uuid": "9a27d9bb-d169-45fd-88ab-0b7dc008a67f", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705431, "uuid": "d4bcb57c-72cc-4c15-b37f-bdcc0ac0088e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705431, "uuid": "e7e99a05-9822-4c9f-a88e-d4ea0b280edf", "value": "IMG4567890008765434567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8117977-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Merlin)", "timestamp": 1766666380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666380, "uuid": "9e9dece4-d053-4194-9d93-fb8c9559f45d", "comment": "Malware payload (Merlin)", "value": "c492a5e8596f42decb172ba9e38cc478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666380, "uuid": "04cac000-650e-48fd-a34c-ed5cf02feec9", "comment": "Malware payload (Merlin)", "value": "cfae52c1076238959f0e15476aafdf094775c30f8627b6598167a6eded8d67aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666380, "uuid": "6191b027-e966-4d55-9d37-39c19aa4ff5a", "comment": "Malware payload (Merlin)", "value": "585c921e67533afe4b576d2ed630e19db9502112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666380, "uuid": "689017e9-2c63-4869-8ec0-e19b1df79cc3", "comment": "Malware payload (Merlin)", "value": "015f709504e7dfb8b353290c7dbb080a91e8e47be3240d65ac3f98dc876fb6422fa215abe61bca9f37bdf8c9b35ffeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666380, "uuid": "69a3a25b-e3de-4890-be25-6bbed2e9d739", "value": "T1F0D65B07F8A145E4C1EDD134866A9263BA717C499B3523D72FA0F7282F72BD06ABD740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666380, "uuid": "ad7aa87f-09a8-4a36-8d79-dc51b23a1b02", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666380, "uuid": "7a6d0336-beb9-4d6b-a9e5-1f163bc6db63", "value": "98304:SoCAHUwZa1XLHwV8Kv8aaTbM0EZQ21OAyzcIbAhc18eihbNfMJE:S3vN1XbwV8XJbCQl1bU3fMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666380, "uuid": "0b64f3bb-1b9e-4b84-8ace-d6bcc8f37e2c", "value": 13562880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666380, "uuid": "d471adc9-da07-4542-9c7e-42acdb8f5b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666380, "uuid": "f3931bae-bb90-4a09-be1f-ea40d7b354f1", "value": "SecuriteInfo.com.Win64.MerlinAgent-A.64485992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9397a5c5-e1bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766686478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686478, "uuid": "028157c6-f128-4e2d-8bc7-ded3282c29bc", "comment": "Malware payload (Mirai)", "value": "d2f5b65751ee943bf2075e0cd67eb475", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686478, "uuid": "53f77a4b-c8d4-401e-90f9-57e08a8df545", "comment": "Malware payload (Mirai)", "value": "d038473a96aed36d55683deaae73b7830ef9bd8a48535f1e88b9263dc2d8f806", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686478, "uuid": "39577c48-f076-481e-850c-ff3087ed86f0", "comment": "Malware payload (Mirai)", "value": "b605054d4667a38fafb0b779c45654a952a177af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686478, "uuid": "892928f4-124e-47b8-bc7e-36807af6102c", "comment": "Malware payload (Mirai)", "value": "714f5613bab13f1bc8967ad6a80583de6478b93ffccf0bf567b914204b4d25ec3bdb7ddd45dfa8e77972238626f4ccc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686478, "uuid": "b42529c4-afc8-4211-89da-d3803a575ea7", "value": "T17E932991BC929612C6D023BBFA6E418D332663E8D2EF3213CC255F15378A96F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686478, "uuid": "7cc78ece-f5ea-4d82-8375-e93fe72572a6", "value": "1536:4ft+D7cscger5Sg2XisSWIbW2o/iTSuuYIqxIaF8ktMTGDAwjUuMEFMwggt2Ev1:4V+HcscgeZ2XirHunMDOTGDHUuLmwtN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766686478, "uuid": "25d5ef92-165f-4ab2-bb81-4453bea8fade", "value": 97016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766686478, "uuid": "837371e1-4983-4698-a4a8-7a9e6c6ad232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686478, "uuid": "144f4c17-1afa-41ee-ba5b-f5987919e9f2", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed13cfe1-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626070, "uuid": "001979c9-323f-49e7-a259-ea12cefbe4a6", "comment": "Malware payload (Mirai)", "value": "4d9888d3ff8e5ba6b80a5bf619e6ab15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626070, "uuid": "74487b95-5f59-4b0b-ad54-bba3a3d96329", "comment": "Malware payload (Mirai)", "value": "d1d13fdd3bb487ed4b4e2dd5f07607ea4d7e4946bc9759ad85db0a0510b78324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626070, "uuid": "0dd1ae88-61f4-481d-a6f2-7951417dc022", "comment": "Malware payload (Mirai)", "value": "6c072a4279ca731b1965fbd41e58cfe4e7961fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626070, "uuid": "8e522a76-3d68-43b9-a214-493d8cfbd383", "comment": "Malware payload (Mirai)", "value": "9f9b89be597b30dab7f39717202afeeb566515ca7dc4c35974b4299db35d42233acb43c0cfba1aa368721982da9910b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626070, "uuid": "db3e838c-647c-4954-bd87-f793d6cf2255", "value": "T1BA431921B9761F13D0E0A47D11BB8B19B6A156DF26A8C64E7D720F8FFF216846803DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626070, "uuid": "73455d69-3639-4311-98be-57aa79ec22f1", "value": "768:v9oOx2ffc/P4/gm62CGShU0cfDTNxFmlJHsnjuVnDXHYjO+EdWTwi:v93x2ffc/P44xwShU0cfDTNxFmXTyXMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626070, "uuid": "1fb49fc2-68e9-4934-9d74-13d230cf3c9a", "value": 55480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626070, "uuid": "24f23bd0-b0b3-4bde-82cd-edf3bacff226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626070, "uuid": "718058e1-82c3-4612-9db1-c39b846f7b98", "value": "0.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74660329-e140-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766632739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766632739, "uuid": "387bf613-64c9-48a0-968c-e9623bcfc3c9", "comment": "Malware payload (Mirai)", "value": "dea2f5cdccae2a25db51a14bc9a6c739", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766632739, "uuid": "48c2409e-348a-4238-8809-7031b3430ab0", "comment": "Malware payload (Mirai)", "value": "d2e8ad3035bf734c4ab18d298b44dae38c3841eb5e37532bef4ca89e3bb8c35b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766632739, "uuid": "2ff33aac-a286-433d-83ed-8dec42830af1", "comment": "Malware payload (Mirai)", "value": "49edb8fdb00950e9771d419a00300e6153d05704", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766632739, "uuid": "0f5fd7a2-011a-452c-bfac-383266f148ae", "comment": "Malware payload (Mirai)", "value": "494719f4e6f6cef338905f678090fe7718379e862ce0e8422fee76c56c93d06f16b42d3aa5dc07afb5bac2f234fc6f6e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766632739, "uuid": "8a99e1af-efba-48b0-a3e5-a3e22de939f5", "value": "T1D731D6DE30114AB229CECE80B6E1F148F4A09AF627F51F74BD96086A6DD7604378D634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766632739, "uuid": "8616efaf-78bc-431f-a8f9-10fdbd252b79", "value": "24:nDdLfiTSXdCV1CX8dCoDadObydmUgdQ9WRdCjRdgJtbdeBIdjyjjJdh8jAd4J78J:nD9K7av1gw6gRsaI4QA6Byv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766632739, "uuid": "f7e3ebaf-c45d-40c2-a919-e01cd1e188db", "value": 1740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766632739, "uuid": "3b238c66-9a0f-4d41-bed7-131b7198e315", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766632739, "uuid": "23320169-6d56-4f5a-823d-cc4a2df6e595", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea1c7e2-e1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766676431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766676431, "uuid": "601ab8c3-4948-43c7-bcef-cb8459fe143f", "comment": "Malware payload", "value": "6b0ecd7bf6a594f76c787fbe0f1030f3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766676431, "uuid": "3435c769-3afd-470d-9354-bb6e4caf9c4e", "comment": "Malware payload", "value": "d33b5367ad01f4d824a174f02575335819ed49d2c03128b107d651173757a46d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766676431, "uuid": "e5e39ff4-f8bd-46e4-90b8-8c8a834fbf87", "comment": "Malware payload", "value": "6fa7872e40d67aac65f00c1746cbf2c289986b3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766676431, "uuid": "d3b7f128-fa8e-4fd6-815d-b58db0272d43", "comment": "Malware payload", "value": "daec0734e335c4517bd1eb81f6072385e94b06a1eeaaaf6131abf4de354d23dfd528ac6333908cf89b06ed0963fad7da", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766676431, "uuid": "12c9367f-4dba-446f-8e09-9a5692b0739a", "value": "T1D6051257B3A930FDC1628278C8591A52EB723876A7109FDF03A447B12F636D19D3BB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766676431, "uuid": "ee696d65-8867-4776-b21b-35111f052575", "value": "f73c6a7c47053d807256877f079ae0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766676431, "uuid": "df075267-f286-4548-9004-fe33ebf33750", "value": "12288:/IDEwe+QGBLWx+TOJyv2zq8chRjsuPUDYYfeUaTLc2VOsCr/IwsGZB8ilLQiZK23:JJ+QxJyHbWYYfiT3VsrIwsLiK23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766676431, "uuid": "5f5e420b-f0e2-45fe-8e98-3f4b35441972", "value": 796954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766676431, "uuid": "2c13533d-9686-48f6-8cb7-97ebb70e807b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766676431, "uuid": "90001914-af17-4c1b-8476-065f699e1e4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f35252-e157-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766642615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642615, "uuid": "de220d93-795d-4978-8a3b-293620c7cfc4", "comment": "Malware payload (Mirai)", "value": "6433e7600b351abadcb1aff4e47ff7af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642615, "uuid": "38d33e4c-9ea4-40b3-82ab-71f73e9187de", "comment": "Malware payload (Mirai)", "value": "d37f1cd9955a1b3ada132eda5d99f071498fcf5415d6dfcbbcf03ef7590d6a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642615, "uuid": "af3a4779-80e0-44dc-a261-491ed808ab09", "comment": "Malware payload (Mirai)", "value": "8964891bbf15959001f5891ccd717222a33e9ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766642615, "uuid": "5f75bd05-cffe-4db5-bf91-a004d1749337", "comment": "Malware payload (Mirai)", "value": "79efa2755666e2148b36c4e7c721aba2cec407d50a8833404c0f8874aadc7dd1a074b3314abc2fe085c2e7960a9700db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642615, "uuid": "4fd275cd-0e8e-42aa-8d50-2bc459ac1ff4", "value": "T1AE54D60A7B519EF7D46FCD3305F98B0128CCB45335642B7A3670EA5DB62A58B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642615, "uuid": "b767602c-4a04-41b8-bdde-53c2487dbb8c", "value": "3072:FXb0nryFoAuINHwtxiN2asQdzD7WPtOrTqBkE7S6VjKpnGqpLmT4Zm:FAr/AuINHwhEJDx/JEFjyJmTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766642615, "uuid": "2a71fe82-06f4-4776-be72-9b1778f23316", "value": 305548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766642615, "uuid": "b09b3c8c-41a7-4ab2-ba54-a12da8c236f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766642615, "uuid": "a19278a4-44ac-436f-8732-a2aabebe255c", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a5e937-e137-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766628735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628735, "uuid": "cc3f3ad2-95d3-453e-a98d-3d43d1488bda", "comment": "Malware payload", "value": "488b0edfe8f0fc24cbec2dadbd378109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tiggre", "colour": "#FE670A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Tiggre!rfn", "colour": "#3F067F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628735, "uuid": "6596723e-0b51-40e7-a9d9-25a0a689e791", "comment": "Malware payload", "value": "d49ec81f7be6eaabac6d77e8bc43a8ec61d368af5caa75690b95c18a6d52bcf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tiggre", "colour": "#FE670A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Tiggre!rfn", "colour": "#3F067F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628735, "uuid": "a971f5b7-d158-4ad1-9bab-b8dc8c6ed950", "comment": "Malware payload", "value": "b98b545cce99a0b97ccc8ab1df6be6b8508ffa6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tiggre", "colour": "#FE670A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Tiggre!rfn", "colour": "#3F067F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628735, "uuid": "7b8d4f00-6560-4a9b-bd2c-17b7892410a8", "comment": "Malware payload", "value": "70fc8c830319dcb5992ed98ff19b6d3f3e16f364a4a3dccceaac6da586115f242cc82558ba5f0ce914acdc5ec6886ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tiggre", "colour": "#FE670A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Tiggre!rfn", "colour": "#3F067F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628735, "uuid": "000e3f61-b6a6-4393-bb42-cb50db1f796b", "value": "T1E87633F4390E574DD0A0103163D7A44DCA14B3DA1E59FA8FE38E9A65EBDA7C3A07D092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628735, "uuid": "d34d5f9f-14f8-4e07-9488-8a88f4f9f189", "value": "de6185b8cdae1e84cb8f9add0b5f8afc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628735, "uuid": "2aee2d6a-bfe6-4c76-8e0d-7e82eefc2ece", "value": "196608:1Kx7Fs3Aepnp0wU9rsX5X/TsB/mpW1POGtzCbb:u23AeFywOi/TsB/mEpOezw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766628735, "uuid": "2fca75d8-61d7-4240-a489-efbc1fb70cb5", "value": 7226972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766628735, "uuid": "0838b909-0eb0-42ae-847a-19ea46ff8dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628735, "uuid": "6de97fb2-62e7-4e53-8468-99798020c75b", "value": "Photoshop6.0 \u5355\u6587\u4ef6\u7248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bc44df-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665470, "uuid": "af435a7c-03c4-4f17-9d29-ebedd58f6b99", "comment": "Malware payload (Mirai)", "value": "25d0e5bb1e6f7f68e960fdd8e06b8634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665470, "uuid": "1e15008e-3843-40db-8b97-3ed1f9faf2b7", "comment": "Malware payload (Mirai)", "value": "d4da9064d8100b8a6ddf5451623b45ad4a295b9b8e6808aabc58430dbc4c989a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665470, "uuid": "91d8f6d8-4efc-4c81-a59a-3f544fed63ea", "comment": "Malware payload (Mirai)", "value": "b47d5c9cf3160390dd6ffaea0e9f05894595ace0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665470, "uuid": "9be334cd-6788-49d9-8a66-148e335cf85c", "comment": "Malware payload (Mirai)", "value": "41302d52d1afa9d77af411f19ab03c5f979ebd7f4aaf2ef934956c38b09d66e5ef91a5719ebb531f5e4bc710acd1a6cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665470, "uuid": "b5edb6fc-cc75-4edd-9000-a4116176e92f", "value": "T160931941BC829613C6D523B7FA6E41CE371663A8E2EE3213CD215F11378A96F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665470, "uuid": "7dbfc449-e0e0-429c-892d-2413ab525194", "value": "1536:QhDfdZXLuEGNGssAYTpQrGdgwKGemWukIBQw9C8S6CJVgvL:QhDfTLuEGNJYTqbrw9i66cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665470, "uuid": "853cd6aa-1972-42eb-8d4f-4444b7ed90ff", "value": 91448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665470, "uuid": "04886d34-c256-4db5-8013-c5b7b5b391fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665470, "uuid": "49a71345-5594-45c6-9c1a-e6d0b87b6842", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d934d9f2-e1bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766686166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686166, "uuid": "c2ec25ea-4b7e-4f49-b3eb-c7fa34eb227d", "comment": "Malware payload", "value": "a1338ed3e2652a286246d2aefec76566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686166, "uuid": "500b5338-2997-47ec-a47f-a73f14d12826", "comment": "Malware payload", "value": "d52f802a52b7dab9e7621e9c51ab12e44024d0de98ee3c87bbb99ce95dedfbf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686166, "uuid": "e1ff6f43-4beb-4160-adf7-8cdf143f8c2b", "comment": "Malware payload", "value": "923b5ffaeeb163e70a953aebe8170c3a4cbedee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686166, "uuid": "9320b6bf-eba8-421b-807b-c20b307bc052", "comment": "Malware payload", "value": "6bda9445eba618fb070eb825cedf66f0f546e6374dc22255d1ff7fa722b541961eced16120a17e26e906fcf45ebabc90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686166, "uuid": "f05e77bf-2a0c-4b8e-ac5f-c8c8a54c2808", "value": "T1B9B32A40F546C0F5ED0748729067B63F8B30E62A82229E54EFA85F6ACB37E46671735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686166, "uuid": "3c917a9d-e8bf-40b0-ab70-0006ad3b4601", "value": "3072:HNYY++ESwrIcBv2XCfiB5iuL+dTe3Dng96+bl4j:HNY1bpB+GMSRjDbaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766686166, "uuid": "cf30beec-b04a-49ee-ae37-5b29af167ff8", "value": 117540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766686166, "uuid": "d0237f68-1625-4bcd-abc1-1f76f46530fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686166, "uuid": "f29f8344-4a7d-4165-a252-d3194e57fc5b", "value": "rondo.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6c8fcc-e1c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690867, "uuid": "8638c71a-75e5-40c9-8cd7-313150f2acb2", "comment": "Malware payload (Mirai)", "value": "17da46f18863768d6242e0d9a0d48a3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690867, "uuid": "ebd85749-04ac-4f6f-bc68-10b9abda6220", "comment": "Malware payload (Mirai)", "value": "d54d5fa510bdfae42b76bc3626c94a9a245888ddab85f0352587c3f1b64ac32e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690867, "uuid": "b92fa6b9-565e-4b41-b999-e36b741aa438", "comment": "Malware payload (Mirai)", "value": "1bfd9c09211e028742ec5f308b61388ad34d84cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690867, "uuid": "3c089272-9e45-4f70-a0d6-f1261b3fdd27", "comment": "Malware payload (Mirai)", "value": "94dcb58a36db2e2164f9d772e085f1d9ab8e136fcd6de7eab3fa210c3ae12ad622af4a52b4313d130b01929cb9958bde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690867, "uuid": "fe33537f-46b6-4105-b9b7-05414b9b904e", "value": "T1D121F009E2456D8FEDA79478181B022A34207A4EE9139012F3258E3F7E7B5D4121608E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690867, "uuid": "37208fac-bcbb-4066-a977-f2b039b6c265", "value": "24:3I6Aa8DzSWPpbP78Pwy74+CiCTHfnhHcwD8ECAfGOpioxht0+SNT1JZ:Y6ApP3hb/mkTfnh8Y8DAf70e3SNhJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690867, "uuid": "f59f4fcb-9a3c-4b71-9aaa-b9318e1ffc66", "value": 1252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690867, "uuid": "e724c5d9-6583-4fe1-8c19-9691c48f9339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690867, "uuid": "3d11fade-2761-477f-9070-2b0bc49a14d3", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3c5c15-e1c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689416, "uuid": "9b4d227b-00fb-4ab3-b141-2af123a7e5c0", "comment": "Malware payload (Mirai)", "value": "7da859d106062a569bb933cb1c6a76cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689416, "uuid": "c4b7b39d-ce95-49b7-a3f9-062fb2f1b432", "comment": "Malware payload (Mirai)", "value": "d65f23ed4751eff3b294e6cff203e561b5d8539974566fe3d79331d4a614cbf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689416, "uuid": "a84e7175-34ce-4622-aa97-5c8d8445facd", "comment": "Malware payload (Mirai)", "value": "9483d6883cdc77cea6cb87e24e3c6fed9611ac2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689416, "uuid": "b9501d28-94b5-49ad-a6cd-7235bfbe29a1", "comment": "Malware payload (Mirai)", "value": "b78c49db3c3921d14a15b2ba3ad0d393e874c1c2c45d1b8bfb67f044d79e1649b7359a2c2eefe3f25a51587152ac308d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689416, "uuid": "0f3db791-3059-4eaf-a181-d95eafffd2eb", "value": "T187436D77C11B4881C3180AB5785ACEF92753B7495DAA2FFD7A598A188003EC8F5897FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689416, "uuid": "f8ffcd51-da5e-45c9-90fa-ca6642050f11", "value": "1536:kxhqc8xHCGsnSvFDbDUmXRbVMBE1SPw5Cy9:AcxFowFDPb0BwSPw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689416, "uuid": "3ea647d8-2ed4-43c5-ac77-bc383b0f306b", "value": 60132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689416, "uuid": "5180451e-6be2-48b2-951b-b31206588fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689416, "uuid": "4b079178-e071-4f9f-b73b-8718c16cc0a6", "value": "shadow.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0575873e-e1b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766681086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766681086, "uuid": "a6f5fbec-e31f-47a7-a97c-5850a4543d81", "comment": "Malware payload (Mirai)", "value": "e05aa1e2b0935e644e08a377addcafa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766681086, "uuid": "7772cc98-020e-4a31-8ff5-d8ede196c411", "comment": "Malware payload (Mirai)", "value": "d6812aabf1ea090f8f2e10ad67db1476c88d3a44126834b83d4f670397773eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766681086, "uuid": "ed74e153-86fc-4e1d-b605-9cc227d6f6f2", "comment": "Malware payload (Mirai)", "value": "b3749145ca412198593fdd719e5c5c0c87e550b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766681086, "uuid": "1f3640b4-060b-46b7-b219-1d65407f82d0", "comment": "Malware payload (Mirai)", "value": "1418e049b263342fbef12d390fcaac6b9dd3a5d8cd2c1e6f87e99f3638407255a085afe99e2acd0d9eac6d80741a0736", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766681086, "uuid": "63e0b817-c924-4b60-a91f-b1e6569f6dbf", "value": "T156837CC5AA43E4F4EC1602753137F7335A36F03A1129EA87D3A9E932BD42A41D64739E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766681086, "uuid": "96c5680f-aebf-45ad-89ce-982f192d442b", "value": "1536:mOWbTOUMAixurWNXLCcvYq0ExYfCSD+KL1y8es7IKoj+ZTtgvR6mPZ:aO7nUrWNXLCcvqExYqSKIQ26j2TyJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766681086, "uuid": "0b059946-0b0e-41c1-b151-191bb00e87a4", "value": 83024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766681086, "uuid": "1d7c1815-0b1d-46fd-a8f6-d59fc47f5559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766681086, "uuid": "eafb1cf8-0f9c-4606-95b0-3d5fca5704c4", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbbc681-e1c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689774, "uuid": "03a78558-7473-4962-9a56-1d902b5cf24c", "comment": "Malware payload (Mirai)", "value": "18c58ac9fc48b2f24efd0882200c428e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689774, "uuid": "5c678697-fe3b-4ec7-8f65-2b227763f1a3", "comment": "Malware payload (Mirai)", "value": "d6a029bdab6f8c739e6673af4afebdb504a0c37eec8d6a03296f6bd907ef34fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689774, "uuid": "50bc0ee5-2ae7-4fe1-b51e-d138cf15bda2", "comment": "Malware payload (Mirai)", "value": "5795ea97d724d0d3dddc2575921136992ea6ee9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689774, "uuid": "dc1d4993-823a-46be-baaf-bc72be54c58d", "comment": "Malware payload (Mirai)", "value": "6404cffab52c7c6c4942bbb902a9a53838315fb9c19ed6ea454104e3d58b1d29c5f658c3eebee86f3898235aeaa9834a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689774, "uuid": "f44393a3-a357-43cc-8c46-887c920754f2", "value": "T1B9A33AD7F401CDBCF94BE77A8427090AF530A3514A930F3A626BBD636D321A55D23E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689774, "uuid": "470bb47b-9929-4551-8f44-06384c9d1bb7", "value": "1536:bxctYA/c+MGrDPicmRpfkaVx2p/SuOyQ8cxBKyGBCQP4UB2OzL4tpui7:VeOGrDiH3V09SuOySwP/BhHi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689774, "uuid": "5fea7f2a-941c-468a-9e1f-67604553d525", "value": 98332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689774, "uuid": "5d090796-750f-4c97-b9f9-72b4729088b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689774, "uuid": "06b242d4-393c-4113-b8d9-d8d90919d2ef", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b830824-e163-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766647595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647595, "uuid": "d2d08e26-2efc-482f-b88a-7619ab6d9e19", "comment": "Malware payload (Mirai)", "value": "30a66ab9beefd3fdc17c91039324947b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647595, "uuid": "eaada8af-611d-4ebb-80ad-a9f63a7fc286", "comment": "Malware payload (Mirai)", "value": "d6c54c13198ec3645159dc1235f8e606c730ea998bdb199a8a75ab7189e4e545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647595, "uuid": "ed8158cf-8e42-443e-8003-66b52389dcf4", "comment": "Malware payload (Mirai)", "value": "d15ff80ce6d4de99b74d12a4de4f1d6c8209770c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647595, "uuid": "fb4d6adf-a93d-4d55-b6c3-c519411d190a", "comment": "Malware payload (Mirai)", "value": "7523d94df81ce9ab125a7f68d2664174616c675dba81e1621c086959576d2315cc9aa4ca6f513e666d772eb583beafec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647595, "uuid": "16d63a6a-67dd-46c5-94c6-46e79c0e0177", "value": "T115242A027B0D0F03D1432DF4267B0BE14B9BAD6138FAE681750AFEC957B1DB1654AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647595, "uuid": "218b3fd8-9a65-4c20-92dc-791d074ac531", "value": "3072:FPHhqVbmVjairxVqNWZsxthh9C51D8JrEhgXpjKsnGKg:F2mJaUxJZsx/h9CbD81Ehcj7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647595, "uuid": "2e3b3f30-533a-47ec-9143-039e108aa4d0", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647595, "uuid": "520ca963-2860-4223-9326-8256cb436930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647595, "uuid": "5ef20506-b41d-43d9-9ee5-2efa4131b49c", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78570a2e-e182-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766661092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766661092, "uuid": "f0ce9770-2bef-4cff-8b33-8dbfe65da426", "comment": "Malware payload", "value": "2a65601b341842c9e068b459da31533a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766661092, "uuid": "532a21f9-5655-4fdb-aa2b-84499cc6b72a", "comment": "Malware payload", "value": "d6e87fb3a6f6bc2527c16a768ab517aec705666f3e8540f21b47e9747ff67e9c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766661092, "uuid": "40804728-f4b6-47f1-9494-53ef1cbd4e71", "comment": "Malware payload", "value": "f74fe9636fad7e9f8d44d3d7cc6b3715df2a4ded", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766661092, "uuid": "9b41449a-7f35-4423-8b54-5871161ca64f", "comment": "Malware payload", "value": "c772b5616e56a42ce18c9476924d5628a95db829cd78765abbc86b7ad120110f2763561e3d28a27b485c9b41a5e8a1ae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766661092, "uuid": "34117b69-63ba-4ac6-b6dd-87352739fb5e", "value": "T113563357A8FE0A6BD3B352F78ECB1B25191B9F3A41891067D89C5825FCF2C41C291FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766661092, "uuid": "925d17db-e077-4b9c-9be3-01e15eb45021", "value": "98304:drtiSYO+tU7gCORHvPEQHVxKwFbsuyLlTBoFN3YKw70O3U2UeSlEYdfc:XiSn7bORHHEQHVAwFsVTBoFBYKw7h3hP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766661092, "uuid": "561e4761-4628-441f-aa28-50abd900d334", "value": 6146188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766661092, "uuid": "0c4db7e9-ca9e-45d2-be88-ff4433156a4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766661092, "uuid": "c776b426-4ecf-4774-a2d1-bacd1e76f6e3", "value": "dropper.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2390bed8-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766690156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690156, "uuid": "4cebbf0b-6692-4d47-9243-2fc141fe10eb", "comment": "Malware payload (Mirai)", "value": "cebd6b5a654a77053f28a8baabb6c637", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690156, "uuid": "1334feeb-8765-45e8-826a-e5215544922d", "comment": "Malware payload (Mirai)", "value": "d80d236e16bfef3dd5b8aacb4aff4226616be790c3b5dc2325af73e71d61441c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690156, "uuid": "9ccca6c3-c4cc-4e06-a298-a71042ec3c3b", "comment": "Malware payload (Mirai)", "value": "980a2b74efa208912e98cfcae512a6a68707f24b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690156, "uuid": "86a0dcd4-c50e-4ceb-a4e1-70659fa2e7a0", "comment": "Malware payload (Mirai)", "value": "9f1fad48bfcde6cc1a5bac97559b94adf1509918bc91338fdeb6b1d9ca921ebdbdbb1d13e234dad19ad16385d908cc97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690156, "uuid": "69293181-6f4a-4828-946b-8f44878e0cbe", "value": "T14A040905BB250FFBD85BCC3B05B9270528CC585A22EA7B36B934E518B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690156, "uuid": "97bf186e-5e48-4391-8846-1cdf1c1ce67e", "value": "3072:AKRmsm1dDG0Gxb/HUctP8XLWcxPM+mkznH4GW88ByT:AKgsm1dDGzELWcRmkzH4bBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690156, "uuid": "c5277d4e-d04f-4cec-aeea-840b3a690c5e", "value": 178876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690156, "uuid": "52228ebd-f308-490d-87e1-6b406d7ae385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690156, "uuid": "ea96c673-5a4b-4a80-978c-acd5d6e6fd5c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2cca76-e1e8-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1766704990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704990, "uuid": "0bf6c380-b96a-4cb4-a7ef-d6b43feeee28", "comment": "Malware payload (GCleaner)", "value": "25543a5746f9a767c835e8e6ebcb3189", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704990, "uuid": "6d002f0c-1b15-4bb9-bc33-7352947e4b58", "comment": "Malware payload (GCleaner)", "value": "d8355067c2d0b6d66ff821fa736dd929cc056f4232329e484774d851303666c7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704990, "uuid": "f8a840e6-f5fb-4a16-a1b3-282adff10f85", "comment": "Malware payload (GCleaner)", "value": "c2b7db6d23cd2df5c4f39e62582b353734183251", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704990, "uuid": "3e8e7023-a8f4-422d-a4e9-dd1525f80411", "comment": "Malware payload (GCleaner)", "value": "c7c8947fec794b3d2e1f9cb1a08d0f0512fa32272ecf34da414583de388b0c67aa1bf8f8da14a87abb923e1638d946c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704990, "uuid": "de7aa11a-593b-4096-af97-1ae91afea043", "value": "T18546E0C7D993B4F3C573457A58396AC8390FAD1ED9D88005A9831C6CBB3528CD82E5EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704990, "uuid": "d9be4907-75bc-4fc1-8b28-63320bb3fa6a", "value": "d9602d58db63e796034d7dc7a7754fb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704990, "uuid": "809e35cd-59bd-4645-9fb0-812f6e23cfb2", "value": "49152:FS89bG2WQPQYiioeiU36GOLfPUvwIGWbHJpxHMcD4B3m3bT5LIHQUJ:FS2bXWy1Ae1wSbRMcO3m3b6HQUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766704990, "uuid": "8064e449-271d-44f6-a275-07d7c787fee4", "value": 5528336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766704990, "uuid": "303a5834-0078-4f79-9cce-53aaf21f6cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704990, "uuid": "4b6316b8-bcfe-43e8-ace8-ba226aa57d0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08207ad-e1be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766687010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687010, "uuid": "eba2e456-3368-4dce-9984-9abbf6ee9ac9", "comment": "Malware payload", "value": "de455e183d381c32dabbb4564527b8dd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687010, "uuid": "82f8b444-8661-46da-a765-a26f0ce4b3ca", "comment": "Malware payload", "value": "d8550c6532aea938bcc90f5c46e11d4df6b1c9f2aaf37c4445922bcd155c7dd5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687010, "uuid": "99701356-6616-4b4f-a27c-213220f7aa78", "comment": "Malware payload", "value": "5ac3d6973113ff17caf7036a3a02389430064a17", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766687010, "uuid": "61799da7-b943-414d-a3ef-3c7c21fa5876", "comment": "Malware payload", "value": "87a9d015df84bf1633c770224969cf97716c581a303845d9cb3fc3b813c0653a6e0af6e2ac107a74e8ad628be7f91ecb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687010, "uuid": "6d01d0bf-3ed0-43e7-b974-862cef5e4a21", "value": "T14C472396F381986AD1F602F68072632413871C254B83D6C77E58353C5DB3AE12F9AFDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687010, "uuid": "a1a2b993-4f77-425f-972d-215f31392215", "value": "393216:bGcqSf0OiD8i7urvUK7V+/537ln4MwmoqUQ1FvpOmw3gMcTnIFh71e3Ou:bGVSfkHuVqJp4rmuQLo+MWIFhBpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766687010, "uuid": "84af199a-d64e-4d51-8ef3-c06f7bc8b79b", "value": 27025096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766687010, "uuid": "025b3a7d-a8cc-4dac-a669-01973eff8e67", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766687010, "uuid": "5fc39eee-ca98-455e-9b9c-d1b2a2d0db99", "value": "Chrome (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3685a548-e154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766641225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641225, "uuid": "71a73b53-9688-4b35-b283-bace09ab1c12", "comment": "Malware payload", "value": "5f43ac25f6842dc16d69b85a67db48ef", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641225, "uuid": "42029cd0-a37a-4ffe-86b0-f2508358c98c", "comment": "Malware payload", "value": "d9ee805904c0d6d1ca487b22482d12f4cfafbe20515fc645c41f767e2e8c43d6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641225, "uuid": "8283cb3f-6324-446c-bbb1-85fc4b39ba5a", "comment": "Malware payload", "value": "a05703aa60dd238875e394c0fa01cfaec7e12bc9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641225, "uuid": "596799a9-4947-43df-9766-06dc2820c377", "comment": "Malware payload", "value": "05574dec303a03dea18b7e3488a96265cee3888bca1f6a5224dd8a390d658985e116d719057f18b51f9140f254ce14ef", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641225, "uuid": "a98b80c3-45f3-4897-bc1e-5955c5482732", "value": "T10EE1B696BCF32419641B406DCBBEA2587059A057474ACD9CFDCC76A8DF4C2A88622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641225, "uuid": "2e774d84-1196-4c74-9c38-e4e1ac9d089f", "value": "192:OZ5NIE/CTK/e4G0llHYoHsfOBro2Tc/OK/Smy:O7D/5nYoHsfO2/9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641225, "uuid": "eb4f6547-2666-43c2-b597-27e7189b54ce", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641225, "uuid": "731ede6b-4360-4647-99da-5fbb5d64fc8a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641225, "uuid": "acf5944c-8c88-4c9c-a2fd-7f59ea5db4fe", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b6cfcb-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666052, "uuid": "f2e8f84c-691c-47b1-861c-b5709fbb1e14", "comment": "Malware payload", "value": "3f0e0f75cf254a0c06fe3654cf832adb", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666052, "uuid": "640a9488-c37e-4cb3-8e95-c46aab623f9d", "comment": "Malware payload", "value": "da7bb0e46d5e0ff32bc928f20a3c3ff03ac1f638390cc95fee2c9ea2da04a8c2", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666052, "uuid": "a3df8380-ec10-4190-b32d-44539a619e47", "comment": "Malware payload", "value": "7e6965f868e6d7495b3acb49667f83d1e41de0e1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666052, "uuid": "7c417fc8-169e-4585-bb5f-f5c0d5a1c512", "comment": "Malware payload", "value": "eb76cadfa85a34bae6f509a8e4fd980a21ee486c5af3ceb8eba843720f5243b5b6d6e98471087d911bba8be3e3980ef6", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666052, "uuid": "1d7cc258-defa-4dfe-9906-e23c91644393", "value": "T12AE6333495A1803AFBF20632F428A6313D6DF3241B55C8A9D7D8FD4E7EA54812BB7706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666052, "uuid": "2f86765e-553a-4280-bf29-40446e493914", "value": "e277f1464e7729ad9df5ec047611738a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666052, "uuid": "67e106fc-366d-426e-a1dd-ea08ce31108c", "value": "393216:1qNIqS79I4IV0FDC8vPFc7Y+WFwtPIPVhQ7o3uaMBBLOkL:1qo9LIV0FDCmFc7N2wtPGVhQ78E7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666052, "uuid": "09452e71-89ba-493a-ad83-afa68e720690", "value": 14313311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666052, "uuid": "e6e85959-5fc3-48d8-87a1-d39abf13db74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666052, "uuid": "5ed8ba48-d442-493e-a955-40f5cf2b50db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8b65cf-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766672988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672988, "uuid": "cea9cffd-6936-496b-b37d-d4f44408ca18", "comment": "Malware payload (AgentTesla)", "value": "cbb844d41cd11b78ae54ba2afb9ce2d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672988, "uuid": "1ccf6dfa-0535-4d27-acb9-f8bb87e2c9e1", "comment": "Malware payload (AgentTesla)", "value": "dac77365d906e8a22f2339a6940bc53862f5e30ab2a030f77149f846e32a47f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672988, "uuid": "0079e714-a4af-4915-96fd-6c2ed9e2c78b", "comment": "Malware payload (AgentTesla)", "value": "06914d196c683cda1b5007865d1c0f237b18dc20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672988, "uuid": "da072849-1323-4afd-b45d-4d3f53e42b31", "comment": "Malware payload (AgentTesla)", "value": "b1704e8cf3887088fc75e932753298f5e821b63cfaa311065660e51dd4d08330b6c07154bdf13cbca40826bbefb6f13e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672988, "uuid": "7fec3527-eba8-4feb-bec8-082c1b9df964", "value": "T1DD26EDCC435EEF3CE7A762211F173018A4A968DADBE648EF74126E8F9F625350560C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672988, "uuid": "716fe150-3b74-401e-bb3c-95784f423d0c", "value": "96:RGm9QpBN5KNpBN5mBpBN5QtWe1/pbtqwXy+7ATl7N5sKb15cOJ5y5uHwz5j5X2/7:R99jwwn7gWAiMDFcUn+Cqo2U0xw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672988, "uuid": "f577b519-8cac-40f3-b612-2c13a4dec3f6", "value": 4450915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672988, "uuid": "b8ef113b-4f08-40d7-9fc3-5f26fbac7c2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672988, "uuid": "76ecc7e4-4a1d-4a85-b23c-a23fb9e9c875", "value": "PO - VME0000079588.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3266ff2c-e1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706931, "uuid": "94962c3b-94dc-4650-82a7-12fd2b991651", "comment": "Malware payload (Mirai)", "value": "1c360806498753fbd9d5885446b16e3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706931, "uuid": "45c3e61b-30cb-4d2e-b4ba-5abc398f426b", "comment": "Malware payload (Mirai)", "value": "daec0d5f6318bb3299ab9827dc6a099a09a32f38f8b69556b2913b2f365d908b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706931, "uuid": "a9b8aeb9-a94f-4a6b-bde0-840c18e50297", "comment": "Malware payload (Mirai)", "value": "73e35870c646dacc6595c726ec0076ba0d11c4d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706931, "uuid": "95b6e0ae-e78d-4bd2-9205-05d7ed259cb1", "comment": "Malware payload (Mirai)", "value": "b7416ac56341cc4269b406a0a7d4e4cf1da2e996f57fdd12c9ba727a91ea847b08b56fc62565b262016cefdc2ba051e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706931, "uuid": "34a4d856-410b-40d9-aa54-0a4592afdc2b", "value": "T171436DCAAB43C4B6F855057124B7EB765A72E83A10F4EF82F794D932B812311B54E39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706931, "uuid": "3bfb12a0-8e73-4e92-b9e1-6eace2084af8", "value": "1536:iU7Ydzz9hVHsjDtqSf3mQ4Ku8xCQKHXRR:iU7YdfWh/m9xYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706931, "uuid": "ad217322-da4c-4d52-ab63-bbd85dab1d28", "value": 55664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706931, "uuid": "acbeae4b-5323-40d4-82aa-2010212995b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706931, "uuid": "ddc3ed96-f1e7-4085-beed-962fda122598", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942771e3-e15c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766644818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644818, "uuid": "34ec255c-eb53-44af-8c1f-6475ece08019", "comment": "Malware payload (Mirai)", "value": "301cf0ec69435beda27c0a57556d72cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644818, "uuid": "c000f2ca-6f09-466a-84c5-53c9423d3bba", "comment": "Malware payload (Mirai)", "value": "db23c081b257a405b09b716875f75dc49b443d06acf6c51a3700bd129e8355cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644818, "uuid": "d0d90dc9-a763-47f0-8f70-249ce8e968e5", "comment": "Malware payload (Mirai)", "value": "40f48d71755465c87ff63eb7f21eca1d7f7d2625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644818, "uuid": "0375a806-f666-4222-ac67-55e7361fed58", "comment": "Malware payload (Mirai)", "value": "87656414565f77e7d28b5503716f06d8db28d6a62d4738debe85b90dc5194bace86f1054818bcdcf2ddbda7ab82ca4a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644818, "uuid": "538ff544-b24d-4876-8820-ca0dccfb7509", "value": "T100A35BDAF401CEBDF84BE67A84170906F530E3511A930F3A626BFC636D321994D27E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644818, "uuid": "08268324-154d-4124-8816-df29c072a14c", "value": "1536:5sLjGezxDxIsU1AkU4dMmBoQFc7YjuSdf58pxWsHGheQNDXt2O04b2SDCg:G5xIsyAxGoSeyuSdfbFNjthHCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766644818, "uuid": "573543a3-a18f-4a24-9d05-111b6ec9e825", "value": 98520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766644818, "uuid": "4ee44b76-b2dd-40fc-981c-0182c7ffb614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644818, "uuid": "2c07a5d2-0344-410e-8576-574daefabd4a", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed2ecf0-e18a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766664378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664378, "uuid": "97558847-0866-4efa-98db-323dbc6be9e0", "comment": "Malware payload (Mirai)", "value": "591d6aed0a7ca4d7b33e371180a3405d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664378, "uuid": "38105ba3-225d-4ee4-aa33-8630d747e2d3", "comment": "Malware payload (Mirai)", "value": "db2e4be03a2217f462d044aed24fce5116d12b5f39330adbac2f487cfa379752", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664378, "uuid": "1ac4e245-a95f-466f-9ef3-262b04265b3d", "comment": "Malware payload (Mirai)", "value": "a0f7f8a1452879a024d24a20de230df738916261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664378, "uuid": "f8119dbd-8263-4c5c-bac5-9dd1d3552661", "comment": "Malware payload (Mirai)", "value": "fea95423b96596c19d2f103f8a91a50d7313a0724e44d032378950c6eaacac8e824a8ef49582e68aad03232ebd7572c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664378, "uuid": "da2ac012-fbbd-48d2-b336-ee63b3212a10", "value": "T1D0A33BD6F401CEBCF84BE77A44270A0AF530A3515A930F3A626BFC637D321995927E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664378, "uuid": "1b47c9cb-7892-41d1-a194-83df42c16a2d", "value": "1536:Vc8OJw4mJ8aR9KwnOr9oY6yR0DkHPBh5E81xt+oGYMQhJjU2OHL3lmvPN:qmJtXKle6PBh5T7hxUhyPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664378, "uuid": "580d8bb5-b3d8-4cab-ba11-8e2d8886779c", "value": 98564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664378, "uuid": "d45ecbab-c520-4245-953d-961cd4b3ade2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664378, "uuid": "8fb15e83-c2b1-4dcc-ae32-82b8c44f1359", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1201b6a-e186-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766662986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766662986, "uuid": "8e6d23ed-ad12-4439-b217-69ef6cc236d3", "comment": "Malware payload (Mirai)", "value": "96885eab6fd0629543f31899a8655fcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766662986, "uuid": "e044e4dd-3ca2-4dd0-ab16-4af29b37879f", "comment": "Malware payload (Mirai)", "value": "dba26268e74ce8defc28783cabb9fb5d6195d1f8c2cfeaaef1f993753e780a50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766662986, "uuid": "f47134e1-42e5-4bfc-89fb-1b574cef649d", "comment": "Malware payload (Mirai)", "value": "e674992864b64488d4989b58c43eb511fe3c8bc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766662986, "uuid": "3af494c7-af70-4daf-8045-f20ece82914c", "comment": "Malware payload (Mirai)", "value": "a0f841b00c64abcfbf6a7657a00644fdeeff45eddc680eafadd7bd01d16dea3982144ae6e9a1a43124df744b43556cdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766662986, "uuid": "f2df97a9-2ed9-47e8-a4a2-cd92052bb744", "value": "T1AA736CC5A603E8F4EC1606746137FB365AB3F03A1028DE87C378AD36AD52A42D54739E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766662986, "uuid": "a16108e9-8781-4e75-ab0c-50400bc12fd7", "value": "1536:bNmrFnbfBOz8f1d/VaeGTItuXX2QJ/GKfFppT6NLCo6B3U8qshym6v:bUJOg9d/VaeGTISXrhpfFDToCoak7qgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766662986, "uuid": "39d55670-e1a2-4ca2-a730-8e1e5941a086", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766662986, "uuid": "4124d649-ffde-4074-bd9f-7c7f482f2ee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766662986, "uuid": "f82f6bda-cf52-4f0b-9450-e66be0496c1c", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce31394-e161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766647061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647061, "uuid": "914eed1a-35c7-4091-941b-25695cbafff5", "comment": "Malware payload (Mirai)", "value": "f27234deb79485e1d48f391cfa7b72da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647061, "uuid": "11412a8c-ddb4-4ce7-8b96-d7b288775f2e", "comment": "Malware payload (Mirai)", "value": "dbb340bc45a31da9c58d588485b1d9ca930604ce8dd7d1dd7f60afd00d609ead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647061, "uuid": "1fe2ee32-db37-4bc7-b9d1-b690e85b15c8", "comment": "Malware payload (Mirai)", "value": "f5e73d053951bb6c9724d41bf27c1ffa311914cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647061, "uuid": "3627fa8e-d3a2-4653-82c3-fc5de82a7322", "comment": "Malware payload (Mirai)", "value": "bb841bb1c24e99e974cd078cc0f2fb25d5e1492617ea07fffb4bb4072f56fd2db0810784fd3ee2e0afa60dde22eb7ed8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647061, "uuid": "9ad6b644-c1e4-4840-9ffb-373c57edc526", "value": "T13F24F947B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647061, "uuid": "5a045254-f8ac-4bfd-94ee-6d1831aa15bd", "value": "6144:Ip4nw6IdA1Twfl4ds0aVGGp8CwZ9YNJmh0jEP2:IKwi1Talz0aVEHZ9gmujE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647061, "uuid": "f46ad902-2d09-4d4e-8d7f-a8ec4c30d33b", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647061, "uuid": "b3fab389-bf29-4d93-b8f1-d4d739bdfc4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647061, "uuid": "0f214627-f63d-4229-94b1-ca0130adcc9c", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f91a9c8-e18a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766664379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664379, "uuid": "bd36428d-cd60-4d4e-b188-d11df8d6fce0", "comment": "Malware payload (Mirai)", "value": "9f6685607ccb183a159b7ceb61a952de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664379, "uuid": "2419ad81-ba1f-4434-8de2-b96dd93f25b9", "comment": "Malware payload (Mirai)", "value": "dc865409ca7509096667f898117f9e422c0daeb160a0a671732bde2ee7f90f2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664379, "uuid": "ae98bb1b-e5ae-4cdf-96d2-84d9b545e92a", "comment": "Malware payload (Mirai)", "value": "374103eaf1b3b67911d84c8a87c58c8570a6e643", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664379, "uuid": "57913a2f-aab3-41b7-97b9-93d24078f59d", "comment": "Malware payload (Mirai)", "value": "8ec1ad0c915a7bd7cd043435dc9ac90fc2aa60840494f1354ea7cd8550fb4a91abf0552d4082d6da50d99c8b5f9ed8d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664379, "uuid": "4a72c8b7-ce43-49f6-8b16-3a2899eb4c40", "value": "T1E1934ADAF800CDBDF84BDB7B4463091AB631A35155830F3A225BFDA36D321954C63E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664379, "uuid": "b2e9d276-2b29-483c-8160-1e771a856459", "value": "1536:EXNkDYfQmGCrHN4+TBgwLXMLGn5j5b80xw8CSI9+M8Li4TT3BBx551e:8QmXbK+P2Gn5j5C8pMciuL51e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664379, "uuid": "1cd11b69-8ba6-45c4-9bf3-22c2481c765c", "value": 89412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664379, "uuid": "ba46da9b-cd4f-4956-824b-075391f4ae2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664379, "uuid": "c24fe673-611c-41e5-9549-08cdd629588a", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75d7965-e133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766627268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627268, "uuid": "fcbc657a-fa1d-4c60-a0d8-464004dce8fa", "comment": "Malware payload (Mirai)", "value": "8a2f31ed318202490972ec0b5c9e44cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627268, "uuid": "01af9833-0bfb-41e9-8d74-40fc805cf062", "comment": "Malware payload (Mirai)", "value": "dcb690747a11527c5ad9919521ffd27a29563f24c19df3d7f9218fdea6e88622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627268, "uuid": "67d3f22f-8646-4ee4-9aa3-865b8d039c09", "comment": "Malware payload (Mirai)", "value": "9c7c14e2159950895f2d5a63b4b44260f121e192", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627268, "uuid": "f5ddc22c-d998-46a9-8c40-851b6f79c85d", "comment": "Malware payload (Mirai)", "value": "90549a3dd1a31c14a4c28a022885b5dddf8acdd82fa85578f44fcb3a80ff61de6cf19fc9c0c299ad566a202cbeada189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627268, "uuid": "cbeeac3a-a3b7-474e-b588-b2804d0508bb", "value": "T135A3B51A6E129F7DF768C63587B78E31975833D32BE0C645E15CE9005E6034DA82FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627268, "uuid": "1426110f-3581-43d4-8ce6-9d0f833fc9e3", "value": "1536:JhpbMid+j4kSQrGiRr0vKyZtT5B7xaiK8yKm0yKKKJissOrGsjOjhSwmkqTwd:JjMI+/RRr0v335B1JVHj2hmkqTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766627268, "uuid": "2ff96524-f0c6-4872-8069-7ba7e26c0d6f", "value": 102284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766627268, "uuid": "38316020-0b7a-4f7b-baef-00ce01d72900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627268, "uuid": "66b8a050-0799-4621-be16-4686a7fcdda3", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f14672-e1b4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766682751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766682751, "uuid": "73cf1ca6-40fa-4079-b490-a7417bfeaa8f", "comment": "Malware payload", "value": "0f967ac0e75fbc70af0558cda1f955ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766682751, "uuid": "704fc3a3-40d4-4036-8547-93277f77e836", "comment": "Malware payload", "value": "dd58f87adbb86e94761d4a7828bd92e560e26f0c1a37edfa386514d7763ffe5c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766682751, "uuid": "7ff1ce8c-9eb6-428a-8cc5-e05e8621a66f", "comment": "Malware payload", "value": "3c28e225e784c6c18084fd972837b19db3b76785", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766682751, "uuid": "4054e3ad-70e1-4024-abf1-8106a1c92dfb", "comment": "Malware payload", "value": "bfbc6d09e9920a787afaa0a7e3d2fc72f56de6a36505349aca83e7bbfc270d520be6ac00dbc5556db8c70d28ec451fba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766682751, "uuid": "19390020-40ac-4f00-8de7-499909106430", "value": "T194E53333B3E698B0D1D6347045A5BBB228B5E8650B0A5BC792404E0EAC5D7F5F7392CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766682751, "uuid": "eb99ff61-7a81-4ade-b541-49191c42d422", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766682751, "uuid": "5606df51-0e6f-4df8-a4ce-5f31f9190ab1", "value": "98304:EN5TpWgkWBS3jUf1JAwCcsKwy7+kM+B/tyqV:EN/WES3of1JdsKwKjt1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766682751, "uuid": "7d7b7ee9-4271-41a1-97f9-050699ea2f41", "value": 3294312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766682751, "uuid": "784f82d8-0415-49de-856a-b8c0d33ff1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766682751, "uuid": "d56e0677-ca8d-4eb2-b57f-7651af69884a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dddd67d-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700884, "uuid": "115387cd-d354-412c-98bf-95789076f7c6", "comment": "Malware payload (Mirai)", "value": "cdc02b698935df51e8c08456795c90e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700884, "uuid": "e6d1c07f-67b0-4f5c-8d03-8f7c85c5df0d", "comment": "Malware payload (Mirai)", "value": "dd8c8dcf82aab0ffc915e874b0a568fed0708e93009eaf927e5496bed4ac0be2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700884, "uuid": "0a9a5898-c258-49ff-ad94-1329add5b10a", "comment": "Malware payload (Mirai)", "value": "b018c018023d849e0c712ac8c8520c3f29d86b51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700884, "uuid": "b3cb04b4-94da-44cb-ae9d-80aad4c73fd2", "comment": "Malware payload (Mirai)", "value": "522b59536a3b8d536b154fb94416ac3255addd138c711ddc0c6bd5c502b96a2584bdc2ec3e3b1a98a7aa0e2d344839d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700884, "uuid": "776c00f7-5246-4da8-a8ae-388737cdcc85", "value": "T1A7246B46EA818A13C4D217BAF5AF414A3332A794D3DB7306D914AFB43B8779F0D63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700884, "uuid": "ae5e6f3c-259f-4b94-909e-060f524c17fd", "value": "6144:1agD9b+e1Htmya/SYKa1O8KnrDRWu0TM/9iHI:1H5Lkya/SYKa1hK5Ww/0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700884, "uuid": "ccd40fd6-4ab3-49ea-b8a3-4207abf7b85e", "value": 218856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700884, "uuid": "9ac98078-3ec4-470b-b4cd-a6069a8721c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700884, "uuid": "f45fcc27-0360-484a-9cb7-7ab419001962", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d308f40-e173-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1766654497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766654497, "uuid": "7da4f163-9852-4063-ab38-887801b318b4", "comment": "Malware payload (AdaptixC2)", "value": "71d7ea1c49adda0f277b686a395d0872", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766654497, "uuid": "e93eb707-ecdd-419b-8832-61100037144b", "comment": "Malware payload (AdaptixC2)", "value": "ddfa43064097e71896ee6d75af3bc211bdeb847da40849c2789339c06b048771", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766654497, "uuid": "f00f6191-a119-4b5d-9d74-27bedc484754", "comment": "Malware payload (AdaptixC2)", "value": "381eff84ba8ed6b3035601b8ef1830d6ee4440dd", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766654497, "uuid": "409badef-ee73-49c1-94c0-df9180ce38f2", "comment": "Malware payload (AdaptixC2)", "value": "bbf3b058a04ce2a17d24710ec185d28efd0e01dec0a07927ebe4f1da044e3a0f52ed770930b04547b198256afcb6b4d4", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766654497, "uuid": "7fc99bc4-f21c-4c92-8b17-08a981b54ebd", "value": "T14F835336E6B3C4ADC05FD634AB8394B3B9F1BC5C4634651947C1A6223B5FD386BAE180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766654497, "uuid": "d0866235-d13f-4da9-80a4-682e8983603a", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766654497, "uuid": "dcecce4e-a46b-41c4-be53-8f4c47a8ecb3", "value": "1536:BmjklNrqI1q3y2z79tGRh++TVSi6nYVa58po0e2/T20yZF+Eka:Uj2K/+b81KSdZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766654497, "uuid": "f08a483f-87b9-4349-9eba-bbca730cb0b1", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766654497, "uuid": "4afe7c10-fb1c-4d3e-99a3-8bf988a6cd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766654497, "uuid": "2c193e2b-ce78-4800-9cec-b7eb9db06ec7", "value": "cnc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2f1dde-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626118, "uuid": "50bc64eb-0736-43d1-abfe-59e21d827a9f", "comment": "Malware payload (Mirai)", "value": "89aeec62d5c202972aa4edded9680de6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626118, "uuid": "3a460147-36b8-491e-ba42-b24945833dad", "comment": "Malware payload (Mirai)", "value": "de0cd31e7130ddd012da48351bbb0a2fde351e9299b692583b2b9e874c361545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626118, "uuid": "33e9d5c0-e8bf-47a3-a468-6fe1543d5a47", "comment": "Malware payload (Mirai)", "value": "de469b482ede38fe9b4a64a4124b1d30cf5eba8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626118, "uuid": "441fd342-7735-4614-b347-5464154459e3", "comment": "Malware payload (Mirai)", "value": "d7e78d451461fc77ef7150df2aff43d3aea1f48c05b38de388f311e45cf2b5c5a932fa0465a89866da8f230779676c6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626118, "uuid": "f75d4c32-5eec-4e6d-b1d4-e8a6d656a723", "value": "T138130791B8815A27C6D0137EF5AE698E372073E8D2CB7227CE600F207AD511F1D6AF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626118, "uuid": "c5c82078-98b8-4551-8bc9-de5a98967b86", "value": "768:E4WWIaZmjF+9TEFkgksE2Up1QqYhbPHAmdO3Ck7RyF9N0yrMyv1mA2EDEy0eYjWa:Ep0mj1k52UMqYhjHAmd28JMBLJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626118, "uuid": "7366548d-eb86-4587-b01e-7b043e6f2848", "value": 45108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626118, "uuid": "1b2a94ba-5dae-4d84-b9ab-dd48598a8259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626118, "uuid": "aa9eb438-d9aa-4fb5-a12e-01188025bb2a", "value": "0.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49137b1e-e168-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766649846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649846, "uuid": "6af6d21a-9eb8-4d29-93d8-d395bdffafb7", "comment": "Malware payload (Gafgyt)", "value": "af9a2fd2ed72581ad22e0d6f8b7ac081", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649846, "uuid": "b0f42439-6612-46a4-8984-637680fb8c03", "comment": "Malware payload (Gafgyt)", "value": "de2027289623210a2aeb746f8de4c6a92b080add00434ee0af27989990b5ddea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649846, "uuid": "797a3449-c8a6-428b-916f-c79bdff0f8e2", "comment": "Malware payload (Gafgyt)", "value": "ca149c35e615ed13491d6ddf9409c801067f9713", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649846, "uuid": "024165b5-cb08-408d-bdd7-d7152b60d9d0", "comment": "Malware payload (Gafgyt)", "value": "0ea36d1bab636c560ee79e679d4a4698eac3cbb701cd100744c5ac6eec32f9d0aad8143eaffc37a9034b5390ce6be4da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649846, "uuid": "c60eb260-1522-4115-bcae-5f94bd2be859", "value": "T13BD30905D4508B23C2D2677AFF9E474F37225BA89B9B332256296EB02FC179D2E3D510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649846, "uuid": "f8b548ed-0e94-4273-b7ff-836d8fb7413a", "value": "3072:4Bupxw7bIfTzhmjaF8E1NaFoOtZjqQGxHolZOP5hEg29gDQHHe8LmyhQaS+pg7J:4S6E1NaFoOHJOP5hEg2re8LmyhQaSGgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649846, "uuid": "98592ec0-2c95-4329-8584-b47c6de4045f", "value": 138870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649846, "uuid": "d06c54ab-03fd-48bd-9907-9968d5f2600d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649846, "uuid": "fc3c5f9e-7097-451d-a1b1-1dd0a7966b01", "value": "i.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745db84a-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766673112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673112, "uuid": "82c17261-3c80-4161-a6bc-5f22b301ed60", "comment": "Malware payload (ConnectWise)", "value": "62c5fa8825365f5916cf4ede5a3eba24", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673112, "uuid": "16728c75-1b1c-4469-8337-ae27fd2459fa", "comment": "Malware payload (ConnectWise)", "value": "de4389a26b3a562cf9aabfe150ad4fbf1f3f577fae8528bdf84b4fc860cfaabe", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673112, "uuid": "ef0dab65-9454-4627-b22e-022b08293175", "comment": "Malware payload (ConnectWise)", "value": "bc58393daec5878fece63b735cc30f26ced26be9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673112, "uuid": "0c5b2a63-aeaf-4d0e-a67d-3679aa4ea8c8", "comment": "Malware payload (ConnectWise)", "value": "8affb48f3453c8adbe5ed652465646892afb3f9bc53f789b4a30ea6c58ea0875ac9f124bb2fba9449e18e92b4c771cc0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673112, "uuid": "e12a7c61-a7d4-4458-b0e5-40c5090743c7", "value": "T16E51336FF54EE2354F3253B3A0A27C6DDF57021A155085A07DAD808DEB2122CDBAD2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673112, "uuid": "fdd618b9-f10d-4f9b-9427-659de49329a4", "value": "48:e5fO0ySN7j7ksLvfbdJsUrBuYaRpunagA+ANtDWE:+O8ksLvBJNYYGunpA+ctDWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673112, "uuid": "1a628c03-1fc8-43ae-bd72-c70e2e90e726", "value": 2551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673112, "uuid": "1a4d7f48-c3c6-4f57-903f-76a3c4b47c58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673112, "uuid": "fc87f91c-2dcf-4292-a73f-14d0856ce00f", "value": "AccountStatement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f84946-e18b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766664813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664813, "uuid": "3307234e-3cea-4a93-aa16-401ad6987d5e", "comment": "Malware payload", "value": "bf0486d6e83f6a2c18091e6e3b19402f", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "token", "colour": "#7CDFF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664813, "uuid": "c09a9648-cc13-4681-9a7c-efeefa6697c8", "comment": "Malware payload", "value": "df756bef30e29daa47407417b19a1c938879fb8d105814ae66c1dfbdde6a8c49", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "token", "colour": "#7CDFF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664813, "uuid": "00c14372-34aa-4cdf-91aa-c973a8bc80d5", "comment": "Malware payload", "value": "2661c20ea4caa9bf2019442fa9bcfa8aabcf97e3", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "token", "colour": "#7CDFF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664813, "uuid": "2c31b68c-639a-4452-808f-673a9fec5708", "comment": "Malware payload", "value": "001d287fc12b523b50ef6d1f57f627091a371e4a53c99f253492a78f8954fd2d9c3e3ea37d41b24d0e136c8219f3d612", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "token", "colour": "#7CDFF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664813, "uuid": "b8cd01f4-e299-44eb-ae3f-27581fe48a3d", "value": "T1034275229EBB2C348183C08E68B5E9413329B507614479B5F5BC423C2FCEE19D9B7B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664813, "uuid": "d0b17cb1-9f15-41e5-b5e6-c233ae04b709", "value": "192:KM9v2CHVSTUk8P3Iq1iinqX2WY10M4XQ+AojzqwZJPPR+keHe5F0un:KM9vziYIq1iiqGtaM4XPXjzHZJXRzmP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664813, "uuid": "fcf92f00-ae4a-4301-a1ee-01a484885a82", "value": 12009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664813, "uuid": "c2ea8640-4338-4541-9b9c-aaa766a38082", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664813, "uuid": "132531c6-bf4e-48c9-87a7-596b0297bc47", "value": "bot.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdc4d5b-e1bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766685662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685662, "uuid": "c30e2790-c9b9-46e4-836b-c438ad661190", "comment": "Malware payload (Mirai)", "value": "eed8de2b4a6ca2810ffb44139e450dc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685662, "uuid": "cca4d607-e2d3-452e-8757-7e0918c69897", "comment": "Malware payload (Mirai)", "value": "df7d59ce27e76c3385efe8cdc1e40bbc889b100d5c4f360df96335e4104b524b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685662, "uuid": "61bf49c3-f40b-435d-9edc-41e7184a8ee8", "comment": "Malware payload (Mirai)", "value": "bd957c7f4922df8eba19b49bc299798a2c7dd839", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766685662, "uuid": "1f0b58cb-3db4-44da-a6c0-add4ed106c22", "comment": "Malware payload (Mirai)", "value": "735ff670191af2da6016c2556096c7e97689138ec78da86b3c22d9e87647928dbbff25c6dd795b710653c28dc84c5439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685662, "uuid": "3c3820ac-9f0d-4e90-b9c2-65bcef96143b", "value": "T101932A55BC818A21C9D513BAFA2E118E3313677CE2DE7312CD205F24778A96F0E7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685662, "uuid": "fb6d37d1-8250-488e-8f22-65cc6b1a28f0", "value": "1536:Kpn0dxHyQkFIzYA9LgaT2IXMYTczK5f2NL5lHk5hb0aHVnQR71dZRiSvW5pJYU:zdxytIzY8E02g/TczKBm1FkTb0aHCvWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766685662, "uuid": "6b013550-3780-4ca2-8029-cafe02d52c48", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766685662, "uuid": "b55fd913-521c-4073-9d14-e854298627b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766685662, "uuid": "57c939fa-d76e-440c-b842-ae3f8971077a", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c79a09-e168-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766649847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649847, "uuid": "54a0df10-239d-4e1d-bce7-aa3469ff0330", "comment": "Malware payload (Gafgyt)", "value": "d0ec579005963fb5352b01d4170d1387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649847, "uuid": "d48a017b-d2ec-466e-822f-920e68144134", "comment": "Malware payload (Gafgyt)", "value": "dfb56c4ba7ae7f510113b3dcac04a9a0f7090d76949ee04235c02796e2a30f1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649847, "uuid": "f5afb011-437c-494b-967e-3d7f174486de", "comment": "Malware payload (Gafgyt)", "value": "e460ae0c461140e7d8656f6677043566ce72e33c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649847, "uuid": "f6e512cb-cc4f-40dd-9b71-9331d52944ef", "comment": "Malware payload (Gafgyt)", "value": "4c6f7a3f233d750c70e63e1b20bc7d676e95433071821f2989d04ce1d508f50c154a14d6f5598ade1de6a619c33bc648", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649847, "uuid": "e7ba8095-6975-42c4-918e-dea6c485a002", "value": "T12BC35B07D4A180B6C48722717ACFA6615823F9FA033971077BD1BFA82F555C8DE9E782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649847, "uuid": "ef3b36df-0199-4cd6-ae7f-ef02016c64d5", "value": "3072:f4Jl4BoQq/Xdp0CEjXF4pha5dZefhVPNemqt4WthVW:Fy/mrF4pha5esmqt4OhVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649847, "uuid": "9c1513ce-44eb-4822-8fce-7b181b1c0863", "value": 127634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649847, "uuid": "07403720-70bb-4007-8947-8f862a3195c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649847, "uuid": "62826cca-a429-4284-845d-350fd0a32bf2", "value": "i.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11d2bde-e130-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626076, "uuid": "c8ac7eca-e347-4cdc-b5d0-d8d09f4be32f", "comment": "Malware payload (Mirai)", "value": "e7ec4d63b4fa441dcfbce4905155020f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626076, "uuid": "56576d4a-db59-4ee8-b794-853214ec5d71", "comment": "Malware payload (Mirai)", "value": "dfd2dbc01ad6c47c42fdf4d3ce0e3d3d495187b7a6be5f9197297bf6353ab163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626076, "uuid": "1dda24ae-e5df-47c7-af61-062bdffed30e", "comment": "Malware payload (Mirai)", "value": "761510e673c76c998ac8fd42899f25de288437cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626076, "uuid": "731f6431-0336-4725-8d86-b2acb1c1bdac", "comment": "Malware payload (Mirai)", "value": "ff4f743dea6d4731dc1a5fb1446783feb7ced263824df0707a665eafffbbc6f76b0ba2dc609bb122f44d70061856f839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626076, "uuid": "bba8b0b4-201b-4b87-b7ef-bd75a5082199", "value": "T10BB2D0ADF951BA8DC99D8CB9229A8BE04F50F881731B9FE95B468DC4D638A47B40C070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626076, "uuid": "d7549496-419a-45d2-9d1f-e58f68b7ed7d", "value": "384:TdjePUORTVRqNMq/E4mXkWJv2M678IJQQ3HO7TraJNhNszdzVrVFG6Sit5RWGVCN:TxePP4Nc0ev+T4vrwNLsz/fG6SixWCq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626076, "uuid": "a1948e76-a147-4d96-b8a0-d6a567cec1c7", "value": 24152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626076, "uuid": "c3397163-fe85-48ae-aedb-18b9691a6551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626076, "uuid": "2c6b5f36-b646-4a5c-8cd2-2e4be826bc11", "value": "0.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a230f30-e163-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766647593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647593, "uuid": "3fe20264-a2e3-4c67-a603-f9652e0566c8", "comment": "Malware payload", "value": "0b92bae8d419053419141be2cb30056d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647593, "uuid": "4781318d-6154-4c77-85bd-d39571646e88", "comment": "Malware payload", "value": "e0749b754c0d0ba06fdf53412b64c0baa56471c046e78568fc94209448853b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647593, "uuid": "00512ada-a246-4f85-a154-e1b01df543a1", "comment": "Malware payload", "value": "3a7bf64a05e601259f85c45c376b5f8ffe04c27a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647593, "uuid": "a45eb11c-790b-4dfd-9b11-11fceffbb86c", "comment": "Malware payload", "value": "6ae6c80a3aad25252496259b41ccf2512007c356fc8ce6833f6e694b7290ce4c5d5853ee1d27854a84f33885e577d5bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647593, "uuid": "59589614-e62b-4b14-afd3-d4d3a73e0ecb", "value": "T131D35C22F87E592BC5C0517651FB4736E1F2638970BC460E3D731E8CBF6169022A77AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647593, "uuid": "f1c5609e-09cf-472c-89f3-2e3873e7caaa", "value": "3072:sWlU/VafzoIDLXPIGUPw978Lo4lRjsXix131sbdiGL1etsFNtRZkauMrF:sEb7LgK3Raa3rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647593, "uuid": "3bc9daed-2d42-444c-91a9-dbc8390b7456", "value": 130152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647593, "uuid": "72d1b91d-3b3c-494c-8e7f-687f647b0e18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647593, "uuid": "1d680426-a5a0-4f6c-a912-832c11674710", "value": "rondo.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b0f76e-e1ea-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766705673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705673, "uuid": "1809ed7d-a4a0-4c25-8c38-0e808fbf25fb", "comment": "Malware payload (AgentTesla)", "value": "1701eced369e4644e33f52e242fdfc61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705673, "uuid": "5631bfca-f15b-4aa4-87ec-302ecf383414", "comment": "Malware payload (AgentTesla)", "value": "e1345fb134e131300974cc55448bdc0f547c13502a298496f0762e09fbe9be7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705673, "uuid": "4a92e49a-1bf3-403d-8698-937670bbc2ef", "comment": "Malware payload (AgentTesla)", "value": "01a5d87b6a3bb0dce9b03bd4974c82d268ae76c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705673, "uuid": "429d9c18-19f0-4b54-8ad6-b928d47529f4", "comment": "Malware payload (AgentTesla)", "value": "72dd08b24eb65ca75f13e4d40263ba09d1a92218f93757b09c059e3f6840bb43d20987cb757289fcac75957895bdbf8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705673, "uuid": "f0abf6c6-77cf-42f2-9b7e-38c43f251537", "value": "T1C0F4229266C16962D22373318432CD9496B83C71CC69727F876EE7AA7C743D3DE2260D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705673, "uuid": "367ed81b-2e4d-43a8-a271-8ec36872972b", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705673, "uuid": "bb596a45-e5dd-4126-b49c-49c82643f44d", "value": "12288:Hz7hU5I5yuNHIgzSFKxWltRohBfSTso93U/aBBevnaJw313CmuKqUKrV9c6eJ14L:Hf+iN57Gtene3w6i7VNKrV5eT473", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705673, "uuid": "9bcdfa8b-fa8d-4224-a646-9c1b07ed14e2", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705673, "uuid": "5011a00c-22c0-4f5d-b734-817b1cc76149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705673, "uuid": "b609b176-cff0-4fd5-9d00-2750037123e0", "value": "tmpcih5l97u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfd972e-e146-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766635277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766635277, "uuid": "83cda5eb-29c9-43db-b7e4-51b25760a6e0", "comment": "Malware payload (QuasarRAT)", "value": "bc2472e883bddf055ee9f945dee71a21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766635277, "uuid": "58e8b855-7a7e-400a-9afc-fd7014158a52", "comment": "Malware payload (QuasarRAT)", "value": "e1b8b76b327b7253e25566550b8d05c711522e5174ac75da9c2409920e372e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766635277, "uuid": "97dae23c-112f-40a2-9be4-17a30c39f255", "comment": "Malware payload (QuasarRAT)", "value": "af9ee93d05e50c1814f00b1491c95cc37a2d5f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766635277, "uuid": "6af3961f-e070-48bb-8c67-b1002b8f81a4", "comment": "Malware payload (QuasarRAT)", "value": "26c517c790f3eacd1f0c4418126f97e48f97c540996c3a6dd80964d12bae4033274469ae588f9b5832640151e31dcc30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766635277, "uuid": "a58c259c-2911-40bd-9ce4-829cff64dfff", "value": "T19EF5338DAA95DF61C72B7FB0C249507582B0D6B902E2F3E7F9D53EB409C137C641A982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766635277, "uuid": "36dc1129-471d-4a39-ac2c-8ecb59b589bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766635277, "uuid": "0dde05e6-e908-403f-92e6-98db40ea2dfd", "value": "49152:oRgVmjO5f37mY4hIpY/fyFKKLrD5PDH3gGGkWUBrJ2YT1zMk16mkHeLZlwyf/:LmjOf37mfIp9L/9H3g6WUr9T1zM4WZyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766635277, "uuid": "aec4755a-4055-4f4a-be0b-67e2c6e9b119", "value": 3385856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766635277, "uuid": "da705298-e2b1-4214-957b-e9c2103946ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766635277, "uuid": "112e60b4-b026-446a-9688-4d8d52371442", "value": "rPayment_Confirmation12242025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9de038-e1cd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766693205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693205, "uuid": "ec6d5d20-1aa5-4a04-bfe5-0f2e75766181", "comment": "Malware payload", "value": "ddfe51242f63982e0d180f19a9329c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693205, "uuid": "ec95a322-4954-40f3-b491-cf37a1164bb7", "comment": "Malware payload", "value": "e21b019a2a192a6950b0bfc57ed95371477e28aed0b5dc03dd9b2e568e69fc98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693205, "uuid": "b7a42c5d-19db-4d9b-8f0d-79a7a8bf5a31", "comment": "Malware payload", "value": "1877e07192d912338c1b09b9776716ae42b57674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766693205, "uuid": "17e4dd29-9d1a-44a5-bdf6-1266a8233d11", "comment": "Malware payload", "value": "b301be6983f87f64030b85f568bac7c066335722e5bb095ba7f1bc1820b837798b7d876ab31ac432c866e249848c4213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693205, "uuid": "d9a87b56-bb95-4c2e-9657-f2e4dfcce328", "value": "T145086B4262EA05C4F9F7DA759AF65617C673BC122F3095CF220C17291F336E09A76B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693205, "uuid": "b54caf7e-0748-4165-8193-ee4f6ae3c72a", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693205, "uuid": "fcaa958c-6ae4-4f4b-b201-bfadd71774fd", "value": "393216:0IFqKb+iUHdZQKPAg9hAJLPU689cN0DshEQu58EASEhoIaE2lShUcBs4DJ7G15Pn:0ndQmQJhnVn0vSa5rs3wbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766693205, "uuid": "3403846e-030a-4b27-b62c-5d9fbbfffa2a", "value": 82235229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766693205, "uuid": "d9791479-08bc-40b8-b275-7d891102fb2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766693205, "uuid": "0347f225-b7b0-49a0-9943-7ee7c9d6f177", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fec233-e131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626116, "uuid": "ddf88ff8-b333-433b-9b5a-2c5e7271111c", "comment": "Malware payload (Mirai)", "value": "37725e3ba1b57720bb48ef84786ea15c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626116, "uuid": "928248be-21df-474f-b92f-dc1eeee0291d", "comment": "Malware payload (Mirai)", "value": "e22eaa0efd2ad956bbcecbeee3e6e1e6cb17cf7ff3c4904998614dbcb6dc44a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626116, "uuid": "e49409e1-78b8-44e8-b0a8-dcb246335d35", "comment": "Malware payload (Mirai)", "value": "e27cc4b3090f50c4ebb1dcce5de9806487e91393", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626116, "uuid": "c209a297-52ac-4b2c-b20e-587a2a647845", "comment": "Malware payload (Mirai)", "value": "aa255bf2bc2d5689a422d68d9045f1daf93e68cf9693c84bf4e63a5b4309c255caf74a1cb23f4b58f3f558cb600f3fc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626116, "uuid": "18676ce5-34d9-41f9-abb5-363c89c4e6f6", "value": "T193232AC4F543DAF9DC4709742132FB279F72F2AA2258DA93E3B49532AC91342F445A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626116, "uuid": "c97a369f-be51-4eae-8d76-0fa18cbb905c", "value": "768:8CtfG487E2DVdAPBztyQ5VYUiwV78IEfBHWc/a32einW1O2NCxctuUauae45CFA6:8Ctfb2DVdAPBRyEYLvejLN4lUauaX5KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626116, "uuid": "99848525-2b22-4796-b4f3-42453f3d6067", "value": 47344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626116, "uuid": "655ffc38-0231-4422-a740-47f7679f9825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626116, "uuid": "c7aafb43-be82-4c68-bae4-41480fd3b23a", "value": "0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92934240-e1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766703227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703227, "uuid": "d0a26932-0e02-497e-adc2-80fd95d08e53", "comment": "Malware payload (Mirai)", "value": "38ed98f3fbc87d13cb9776c941940403", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703227, "uuid": "37ff164c-aa3c-422f-8215-9634ca41d2d4", "comment": "Malware payload (Mirai)", "value": "e2da955d2d5fadbfd6ce0776e80a7602317ebf1edbfaca5d872c7f5a3cb0da8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703227, "uuid": "773d296e-5999-4ef9-8cae-46847b8b2ddf", "comment": "Malware payload (Mirai)", "value": "bd2c18336c87be1b13f23b184bb7152d0019aff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766703227, "uuid": "793532e4-9032-4ebb-9b57-6db5aaccaec0", "comment": "Malware payload (Mirai)", "value": "c21c057da42692cf5a94d2ee22cd4cb7e91e464b95ad0f9f652d87b93e8e75428d8b25ab8bf93bb2d756900cc62690c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703227, "uuid": "d90d8613-117c-48e9-98ab-03f06e3334d0", "value": "T1D983079AF9819F11D5D566BAFF0F518C331347ACE3EE72029D246B25278B82B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703227, "uuid": "1ee0b150-b6eb-4049-9ef7-7b69449c54c8", "value": "1536:e1tnZdvqbEnMw90F1XjPzDkfQz818xg4jDBO13HdNlkQkizxfUj/7q4ZlYm4HT29:Ody+0HXjPzV88xg4jDBOMQZxfu7q4LMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766703227, "uuid": "85dca540-c54c-47bc-bbb3-420318896dc9", "value": 83948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766703227, "uuid": "6737eeae-6acb-413c-958d-89fb0d42c39b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766703227, "uuid": "62a25525-6b4e-446e-b610-53323713d5da", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3fbea2-e161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766647063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647063, "uuid": "35f77be8-c691-40ee-a60b-14c047699ab8", "comment": "Malware payload (Mirai)", "value": "1e064f3c7d3e3f496d7a7d95cf9fbca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647063, "uuid": "92b75e62-40ed-49db-ade0-66c01b9787c4", "comment": "Malware payload (Mirai)", "value": "e312bd190dcfd0bddabcfd488d2b14dc16652c721e8736802ece2f3e11e09af9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647063, "uuid": "4e520cd7-943c-4fb9-a49b-2fa987ef4f3b", "comment": "Malware payload (Mirai)", "value": "c631914e15018d9c4e195db8fea161ddcf459b3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647063, "uuid": "ab247aa7-aeb9-4144-87bf-52cf8065c0de", "comment": "Malware payload (Mirai)", "value": "1f6960f2d7ea5e1098850155601d08b447c725ea25c303dec7a086945db9e8e14ba7aa2538ecba3107a53f09e2a9d74d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647063, "uuid": "da2f6c17-e4d0-4f52-a2f4-54fbd8ac2c60", "value": "T1D8241A90BA59EC32C05E1D3667FBDB593B0369D14EA2D104C460EBCCFB875C0AB9857A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647063, "uuid": "3980f0c1-bf27-47a1-bba8-42e1e80ee768", "value": "3072:fwObuMhXw3VZRO1nPqaamynmetqu4R7vdkiVh43PwH/jo7nGGs2+:btOFZsdqa3y7quyPVh4ofjys2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647063, "uuid": "1db44805-e17f-4903-bc24-2cd9efa1b442", "value": 213080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647063, "uuid": "fca11df9-088a-42a5-b8be-94607b108ebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647063, "uuid": "f0333966-6cce-4c4b-b068-d9e1939c0588", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37b08c4-e12e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766625221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625221, "uuid": "8f5cc56d-2e88-48f7-b43f-ecd08712d382", "comment": "Malware payload (Mirai)", "value": "45d1ee54bfd8cd8a5c7daedbacff6246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625221, "uuid": "a3bea1b0-caa3-4e29-8718-49c2c8f8a344", "comment": "Malware payload (Mirai)", "value": "e40a515af36d187ea6a3ab5462061306f9ce49fd8a19943a2045d600d2b45760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625221, "uuid": "864032b9-3125-4e42-9f6f-1f114492318d", "comment": "Malware payload (Mirai)", "value": "4939712bd1b648e153f264bc2e8b77fd084929a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625221, "uuid": "669e5fcd-b193-40d3-bea5-6b783c543405", "comment": "Malware payload (Mirai)", "value": "a719a0a4305de880b69bba215c612aef299b52bb9e25e51d0f73ff9628fb319c529a1366b82dd0e51af134a8219e2766", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625221, "uuid": "62fe790a-9e75-4f2b-9945-1936fd91991c", "value": "T10E834B21BD792E17C4D4747E21E34334F2B6274A25ACC61EBDB20DAEBF116503153ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625221, "uuid": "491d5a58-1fa4-4ae5-9f5d-0ec8aa68fd4f", "value": "1536:vk+ZS/gZ7kiF+JB+kXZejbVW2KImVfua/YtgfEfJSEoIs/PTzAeZ:vLgTc+JH+Rrh6YtgIJ7SPTz9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766625221, "uuid": "aa672156-7359-4ee2-b26e-54bb9a035d19", "value": 84188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766625221, "uuid": "12c26158-f78a-4e0f-93e7-424740954120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625221, "uuid": "e902bee0-5df6-445d-85e4-bc6cdc2e0110", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8a74f4-e189-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766664082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664082, "uuid": "99f0c27b-5fe8-4e87-9da3-16f908fdf645", "comment": "Malware payload (Mirai)", "value": "e6c610255538e816ef0fd7ff7b74ae41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664082, "uuid": "7b33b31b-6eca-42ae-9db6-7d8ecae75dd9", "comment": "Malware payload (Mirai)", "value": "e60df698dec7ebcac691344fb309f32f201981293e96e425da4830cf28c74b18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664082, "uuid": "c248686a-6b66-4d65-97a5-0c442213f51d", "comment": "Malware payload (Mirai)", "value": "c001ad1e78b58f347bd667376a686598f91b49da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766664082, "uuid": "08907ac5-dafb-4807-8498-fead33775db2", "comment": "Malware payload (Mirai)", "value": "8cde0efa4baf0192278ce79000349c9109b8981899f430a23a8b341077cd7c58056f1fd42e4806e3b4345606b4c3d260", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664082, "uuid": "761021b9-aa01-4d2e-a3e2-0871a9d73045", "value": "T1F1C3E81AAF610FFBEC6FCC374AE9170525CC651A22A97B757934D818F24B24B06E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664082, "uuid": "6f8f3496-6bfe-4da8-aaf9-b162aa03d49d", "value": "1536:cOzhg36CAig6VeYTlVQpjx+nOhpYvPrpPNnTcy1TBj6EPZx2G8K2w6Z9:7zhg36C5KYTliKjQ6B7Pyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766664082, "uuid": "9cf576f5-e203-484f-a99c-e35a5932c5f2", "value": 125912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766664082, "uuid": "eb5a3656-7cbf-448d-b6ec-b45577064037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766664082, "uuid": "ff96d19d-1488-4618-a61c-c501e23e46bf", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055ddb59-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665195, "uuid": "d0d746ce-c367-4167-8012-5f2521fbeb26", "comment": "Malware payload (Mirai)", "value": "c77e1de652fcf589ba89c4f63ca9d393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665195, "uuid": "041d71ba-a8f5-45bf-b5fe-e23b42c54b7f", "comment": "Malware payload (Mirai)", "value": "e61d4dea200613cb7bda636fa3272289c9e77bf578b7b219b78f2244e48ce8f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665195, "uuid": "22f16708-2603-4b25-99b2-75340162d589", "comment": "Malware payload (Mirai)", "value": "eadfd9357c015f73e4e03db12fc6ac1066b2b766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665195, "uuid": "114bffc8-9790-452c-af13-4403db1c4f87", "comment": "Malware payload (Mirai)", "value": "0f08b9a86b232b301f38f90a33d7327a930e52008ec69cbf8db970555e9bdac4bab4ed731ff4fd269371323d09ff3b4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665195, "uuid": "97286759-3f32-4b0e-8820-fe1e4e42786f", "value": "T124533A21A8792E17C0E5F57B22F78328B2F5170E24A8CA2D7C760F8EFF1895065576B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665195, "uuid": "624339f0-6ae3-4df4-b80d-9c5a3bbe7bdf", "value": "768:4SoA7YUFoWq9XgOpo9bDk4oIVT+eJPdIei2py6WlxOO+hBCyFEI:4SBYEJSXgOpgbQ4oIVTXJPdId8hN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665195, "uuid": "25733ae2-dfb1-43d7-b6d7-06d2f38a9823", "value": 62476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665195, "uuid": "1d62d355-873f-4020-9eb3-44eb7b0a77cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665195, "uuid": "7779c064-5ad2-4c4d-9f10-9c9763e3906a", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6934d5c2-e17f-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766659779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659779, "uuid": "dcad163e-5c16-45dd-9e1f-ed21a1d94421", "comment": "Malware payload (Vidar)", "value": "9983e2fb72cbd03945a2ed305537e69c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659779, "uuid": "babcfbac-61f3-4909-b664-01655a306b79", "comment": "Malware payload (Vidar)", "value": "e63c3a07f3e99f3041c64537893189172179183347d1e4626649f5d987b47b51", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659779, "uuid": "2d35e656-bb49-47a0-ae15-55dd5f1f58bf", "comment": "Malware payload (Vidar)", "value": "ea2adfb211b8c8ca174b086f72f49eadbb00eaf1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659779, "uuid": "ee6dd50c-49b7-446a-9c09-f9fc685a11b3", "comment": "Malware payload (Vidar)", "value": "27b601ed9a25b7fa676cd8a1b292a039624137b431affb5ca11f631c8d738d40af572cfe6c7733a2237be79db13ae855", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659779, "uuid": "c8837704-f09a-4969-95fb-61b5e7d9d36f", "value": "T164852244B7F9E523E4B59F749AF299C3993278E06F2047AF5594A02E4E33A84CD70327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659779, "uuid": "3033694a-3b5d-4e8b-92a1-1905eec7b910", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659779, "uuid": "137013d7-4622-40e0-9383-b809dc9252fe", "value": "49152:4DP8x3L+cDK47uIAbWbpMKKW+g/MOQa7/R:4DktviVkwW+gLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766659779, "uuid": "f2c34a3f-f2f7-4390-bf8d-d8400f2fcae4", "value": 1775104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766659779, "uuid": "b16464c0-7508-4425-80b3-b8103a4e518c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659779, "uuid": "23ccbdbe-367f-4cab-aa13-007297751a72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d10d2e-e1c8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766691091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691091, "uuid": "070969d8-0dff-4a4a-ad8d-f96059fae3a7", "comment": "Malware payload", "value": "012329ea776f95bcf3b893d048b8432d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691091, "uuid": "2cb66592-e9ba-4b48-9d0c-2080ed616709", "comment": "Malware payload", "value": "e6ca66f6fe791d177c4db47b8771a074dce49bf9f3a6bac3d19ffef3cca737ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691091, "uuid": "d070c138-3606-4654-bba7-b30be3ae59d8", "comment": "Malware payload", "value": "53ed651cc828c89352c9803bdfc83e68565f5677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691091, "uuid": "b1390612-d5f0-4e3a-8d10-31612e693729", "comment": "Malware payload", "value": "d0c0881b6f45037b31475d84fe1b11fa65bf691bd8609dc6cf4d27f2f6fadb70ff153caf7ac4e3e4ac4bcd60407b67ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691091, "uuid": "85fac61e-9e0b-47ce-8969-28e72f57aa89", "value": "T1F8C41A7DAC60F362F608D0BEE185D3529E2178110236AAD319BE932412459B3DF5B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691091, "uuid": "6bd42552-2e4e-4f93-a1ba-46a54bfda51e", "value": "ec4a3e507f2cadcaf4f3ba70774863e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691091, "uuid": "3aeb4ca5-a48d-4a80-a725-c02f84904a5d", "value": "6144:oiy/0WhBGtUK8z88VeLQiI8MvCobILNkJnDCikykXhCgp/1JsUzvE4w6JOOunamb:6cDv87KkkykT/sUAgsdBiBNlin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691091, "uuid": "e8ac261d-6c95-4d85-9ab2-5b45cee60001", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691091, "uuid": "25e92c08-4bf1-4caa-93bd-94dcf6630b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691091, "uuid": "323a0ef9-0e0f-4912-94d9-63a1405b23d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff4beb3-e18e-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1766666232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666232, "uuid": "c51aa9e0-a4fb-4a7e-87a9-aca62af94539", "comment": "Malware payload (SVCStealer)", "value": "47293d99962eee46f45384ad95b77ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666232, "uuid": "d90d22b2-5743-4349-83e0-968c6dc5fc57", "comment": "Malware payload (SVCStealer)", "value": "e716fecd4ed32d90b1c707da5b419c65a7e1d89b4e416ee69765a3729c1e3293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666232, "uuid": "afc0bb9b-c8e8-466c-b838-3ec800590553", "comment": "Malware payload (SVCStealer)", "value": "450c9c37d5b262f7e0230c8235f0031d1f632b9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666232, "uuid": "1499f4d9-2a4b-4088-8dbf-2864b1890e84", "comment": "Malware payload (SVCStealer)", "value": "ecde2fd965bd3466323496046875c3c9e9386fb5b1cbf4ce0ff3082ff2e1fcc482eaf5887a5c0b02a1ce6ffd7974648b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666232, "uuid": "8cda4bf5-0fa6-4b36-a40e-522c0a5023bc", "value": "T177B4C049366410B9E86B813CC9578A46F6F2785A077093CF13A487BA5F3BBE19A3D311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666232, "uuid": "21577328-d0c3-4373-9bec-661524e24263", "value": "78f0b9037223ba008b9e0f5ebe07069b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666232, "uuid": "2f3fea68-cd70-4ef2-aa98-f81ff1f472cb", "value": "6144:hMhyzNBvnRVjnT2XvZgXXvWsIvWX+qYl2b27UGjY960Q+P5WKnttFX+HAbKZxGzr:ayzNxzVaWX+n7Lm4+PE+tj+gb8cz3ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666232, "uuid": "9070c5d0-9cc0-43f7-9dbd-cb3b618a9616", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666232, "uuid": "3fc99bd3-5c20-43e5-bcb2-12ec17ebb88f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666232, "uuid": "05e83dab-a32d-4c82-b3c9-04f06eeb49ea", "value": "47293d99962eee46f45384ad95b77ef3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3496df0-e1d1-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766695122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766695122, "uuid": "450818a2-0d1d-4aeb-8d32-3860e3f01215", "comment": "Malware payload (QuasarRAT)", "value": "1eb81ba0300affbe3956e87d289d4252", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766695122, "uuid": "0304a94f-e37f-4cb1-90ff-d4da554944f7", "comment": "Malware payload (QuasarRAT)", "value": "e7c30ad28271f6cd25745fe06ea3b01e1c5a50e3991a715fc9b843965e43af70", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766695122, "uuid": "0e62b9f4-b30a-4399-abf9-edbc35190d5f", "comment": "Malware payload (QuasarRAT)", "value": "e850ab86b0823c8556c8d69e066c57b4a6bb05ab", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766695122, "uuid": "80711f9f-3e9f-4ff4-bc14-150509db04bf", "comment": "Malware payload (QuasarRAT)", "value": "a8125f487ce4fd7755cd85fbeb7db40c8bc7cb6458c85a0a2bbd9efbfbb968107605fbc1e03bae880d07bf70a1ea08a8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766695122, "uuid": "9ec473a0-c75c-486f-bf34-5a669ebdb7ec", "value": "T10F4633D409254C99DDCF84790577B3BCEA6C8931288DA94272A4FFC9062B9EC8F79163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766695122, "uuid": "08b1b02c-38b1-401e-ace9-44a3bc015edb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766695122, "uuid": "062eda04-e465-43e4-8296-016ef459cd94", "value": "98304:rS9Ih99hLnTlB/euIVv7aKnRjcirdcFrRr0fQKT9tn/OOyZPo4d:+OhrVPGTeKVprdcFrRavf/OOyBo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766695122, "uuid": "041a6571-9a50-4ad7-8884-4daa509f6d38", "value": 5393408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766695122, "uuid": "24b96f83-3ab6-4b26-8d72-d3df286de917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766695122, "uuid": "a8ffec6b-8959-47d7-a60e-a032804975a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75013e7-e1c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689599, "uuid": "de331fce-d3fb-4550-af7a-2d537dcb9070", "comment": "Malware payload (Mirai)", "value": "ed93ea4743b8e5a93795168e87bbe3c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689599, "uuid": "82e433e6-bc88-4a9e-a141-8119278691cb", "comment": "Malware payload (Mirai)", "value": "e824e8f0c6bf036d3247237aadbcc57000ef12b13932e6069e19b8caef637570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689599, "uuid": "978f72a4-2e4b-4541-b647-668f0506e594", "comment": "Malware payload (Mirai)", "value": "f191a955882fab09a8d220d068761fdef21a8389", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689599, "uuid": "fd476266-49d8-475a-83e3-905f4694cb7b", "comment": "Malware payload (Mirai)", "value": "1ce36a763337b002141dd8448e1c5b666bb4f794ea245484ac961833eb9d6bf87783e40c92b739fd3a033fc9ef477a81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689599, "uuid": "24826397-15e8-40e4-9538-039af2ed4263", "value": "T14C43F941BCA2966BC6D063BAFA6E518D332573E4C2DF3257CC104B117B8961F0E77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689599, "uuid": "84ba869f-7631-411f-bf39-434a31689284", "value": "768:wdHMoyi/yaEL9NCfkuDl+oqNv8gKri5GAiP/H8m6Vh3AWHIGQneD3OvBrosw2BNL:YVaay9NHuh+lvFKYU8h/3AWHIfeDuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689599, "uuid": "42552dbe-1f2c-464a-acae-5952f1c09017", "value": 60120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689599, "uuid": "7c025183-b043-4e10-b0d7-fc0b94549061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689599, "uuid": "6386721e-9505-48e7-8001-e58cf120d3ed", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e0900e-e137-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1766628681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628681, "uuid": "58866efa-2bac-445a-942a-dc9219e503db", "comment": "Malware payload (Gh0stRAT)", "value": "7aa22e90171e5de00dcdd58d39d76ec9", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628681, "uuid": "987f2c06-59a9-4953-b1a7-1eaa7ddb3e3d", "comment": "Malware payload (Gh0stRAT)", "value": "e87ee6a08389cc69f3208247e0e65be770ad1ba5fc3e566aa3abe920ed8fc741", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628681, "uuid": "8800475c-2e10-4571-bfac-b4b92da5da66", "comment": "Malware payload (Gh0stRAT)", "value": "c9a94665337a0e1e794cff942ec524d7aa44a57f", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766628681, "uuid": "af40e950-2a89-44e2-80f2-13e9d774e551", "comment": "Malware payload (Gh0stRAT)", "value": "95eba183787250f53d4fa1770b0ce6e4e90a42a799ddc79077a0496d56587efb0af020b305b76cdee55ccdbd3e606bc4", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628681, "uuid": "62fb1914-7cbd-44ae-a0da-97df7b9f1ba1", "value": "T1D7473321B6C7C632DA6D017AE969FE6D093DAEB3432011E7B7E43E6E84B0CC14675706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628681, "uuid": "d2658757-37c8-4dcf-9b8f-27453ce48933", "value": "393216:ka6+LqVJEaFgChO4/YfvF06N26OCBeSZgDJCGO5LcM1qSDog8kb:kogJzhn/Yfva6Oy2AGALcM8SDR8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766628681, "uuid": "4c05abe1-57d1-4f6c-bab0-e55a9d7a87fd", "value": 24851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766628681, "uuid": "98366e05-872d-437a-9e80-34a1e55e0bd3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766628681, "uuid": "4ccf2d32-1d79-4fbb-9b78-b1bdba9554ea", "value": "ChromeSetupx64-4550.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49ebdf0-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1766673327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673327, "uuid": "a45409b4-7da7-4570-998d-1659bd8b828d", "comment": "Malware payload (VIPKeylogger)", "value": "ea133926f8958351baaef2391ff78752", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673327, "uuid": "14f1aff8-a04b-4a5f-9264-bc3f0270e8d6", "comment": "Malware payload (VIPKeylogger)", "value": "e906fedf3ac9c621733cd9b6016300d6f8af6a8473e32cd6d8523c08e29b580d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673327, "uuid": "99f4746b-4dc2-4acf-b6ca-0d224d05790e", "comment": "Malware payload (VIPKeylogger)", "value": "a8ab85a1d2976e64b8c6d6276dee1716d5f5be35", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673327, "uuid": "943b1a30-559e-470a-9208-b564d2c37ec2", "comment": "Malware payload (VIPKeylogger)", "value": "a31901db1a692a43f5a671296bb8f48678fc296ca413e5cd6d17ea65633c6ff7dfacbc3c2f7ecfa203029f8d0718b78f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673327, "uuid": "81aef2cd-9456-4877-a299-a7965e164ac2", "value": "T12005DAE5C72765BA1DE288C943159FFEDEDBC272308183757E4B982CC682DACA09C45D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673327, "uuid": "f5b75132-b01a-48fa-9293-d2778ae849a8", "value": "192:JSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS7:r3+pWpR1DkV9cF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673327, "uuid": "0a7fdfe1-772d-40c4-aa0f-e2497bb111a9", "value": 823429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673327, "uuid": "e4ca509d-aa40-446d-a322-f929670d7166", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673327, "uuid": "48013f49-7422-4c9d-bc16-d28ca4633ad1", "value": "ESTADO DE CUENTAS-2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6f473e-e1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766705396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705396, "uuid": "2461616b-fb57-4add-b953-9abbd4ccfbba", "comment": "Malware payload (AgentTesla)", "value": "dfe01376ceba22e8e984094a0b7c0a91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705396, "uuid": "15a971fc-7303-4f18-84e7-a5e058d4cf78", "comment": "Malware payload (AgentTesla)", "value": "e9f461c11e56ad687f2fc464022358050f4cd6f3526edec282da189316c4488e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705396, "uuid": "01d95133-6152-41fe-bdf9-ce994afdc4dd", "comment": "Malware payload (AgentTesla)", "value": "7bc0333cb116308de650ab36deed078fe5011b47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766705396, "uuid": "a968874b-3350-4909-ad1e-e96562828b13", "comment": "Malware payload (AgentTesla)", "value": "fb85057e1538a7900e86cff68a70cebd1c0128cf9ef6c197cb214ad66d0812147898694dca62a2de58cd5425d6c543da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705396, "uuid": "0814e077-8b11-4f58-8c2d-01355b8ee40c", "value": "T13745CF0273D1C062FFAB92334F56F6215BBC79260127AA1F13981D79BA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705396, "uuid": "87f86fe6-1225-4fb3-b013-05082a9f448a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705396, "uuid": "027f85ca-96ce-4a7d-8e35-14674337da88", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdai8xGm59naM+doTy:tPVt/LZeJbInQRaiaGmLna0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766705396, "uuid": "57bdd1a1-4892-4aa6-b7ab-e3ef4c7b36e6", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766705396, "uuid": "7068b4f7-2bcc-4e52-841c-e8b515b21d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766705396, "uuid": "e02aa36b-d06c-4b42-8502-07ee77c9ab42", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9f2cf2-e161-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766647065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647065, "uuid": "268a48c2-7623-4348-917f-092721714f40", "comment": "Malware payload", "value": "a639e889218a12a17b08758375f22435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647065, "uuid": "b9f9c115-5a82-481c-b5a2-9cceafcd3ba1", "comment": "Malware payload", "value": "ea2584d1cac823dac7cca32bf1220a31a749fa67f3c4347247fb797c68708768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647065, "uuid": "17382d30-3826-437e-a8bd-86445f92a4b7", "comment": "Malware payload", "value": "30b579df6723b86ec1da1679591cdde7e89e1d5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766647065, "uuid": "0841d622-33e6-4ffa-94c2-2c3c0e74a7d7", "comment": "Malware payload", "value": "6458bd2ba3c1acfd7be6676746822229242767dc2ad28e0a4a326a7f97b6c43126dc9b1614a11d123b187937a325e7df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647065, "uuid": "304ff5eb-3965-4542-94a2-ff9aa9d886d5", "value": "T15094D052F3107EA3E10A9135548147406B84AE7973E2D302FFA7B1B9612F5B5CF287AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647065, "uuid": "debfce2c-b0b3-4e1d-ae42-e6595675a031", "value": "12288:VKqiq16GFIcuOq0BS+nHkrlPorNEASyUZ1cz5Z3y:VbZFIL0BTlmZK1ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766647065, "uuid": "03f35bc8-5216-411a-a87b-8690e5c09792", "value": 431072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766647065, "uuid": "1b3e39bf-7e00-44d0-bda0-27e6d05eb08a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766647065, "uuid": "26bcdbe4-32b6-4d5c-9556-06f30183229a", "value": "rondo.armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c83958e-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766700935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700935, "uuid": "01894483-b615-4f3f-86e9-28f472aae7ce", "comment": "Malware payload", "value": "38f8ad1460a0173d32f525c369be7667", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700935, "uuid": "d1b254fa-3158-4024-bf5c-a6dd16c87c7d", "comment": "Malware payload", "value": "ec0a51bf2ac7912ca045251edd1c075b077ec7babd95c1d73417d11910c3febc", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700935, "uuid": "eddc6e14-5bb9-4b51-a42b-61a23a502246", "comment": "Malware payload", "value": "7d44127f98fc3b8c218cfe1565e87f8050b9ff39", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700935, "uuid": "edb8681f-d8a5-4d51-a693-0c15c87abf95", "comment": "Malware payload", "value": "ad60129bfcb579247116ecdb1fc99dab3df1f641f5abbb67bead66cc0882d266fefbfcc7890e7243a5971c636c8b3120", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700935, "uuid": "2062fc6d-b205-4aa0-bb17-258a48cf6012", "value": "T107380264A0278428FFA7F1C74F9D2F94D3A982FDFD55234889728C70DD2DDC62629648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700935, "uuid": "b91e2f25-de49-4996-93d1-e434ae350989", "value": "196608:/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvP:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700935, "uuid": "d83ba5da-361c-4edb-998d-7d67eb413c62", "value": 102696394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700935, "uuid": "80033b9c-830f-4d8e-9ced-de107b7b2487", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700935, "uuid": "c3e09d58-98fe-4c8c-a3f6-6dc55aac3430", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cc67e3-e1c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766688422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688422, "uuid": "35733fcb-4ac3-4b38-9e3c-42858baa8981", "comment": "Malware payload", "value": "b81254325b611d35c239b05dcd9ab0af", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688422, "uuid": "e87cb5bc-a477-4c7e-a51c-6988e07ed9d3", "comment": "Malware payload", "value": "edfa8ebb456b3fc9176aa65e806f9dc80f38ea05c44c9951e188a2295800e409", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688422, "uuid": "f2bd6605-f5e4-40b8-a453-c5658314a4af", "comment": "Malware payload", "value": "ef54e090d41f4f25d39a2ea3609408edefa880e0", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688422, "uuid": "791ee93b-503f-4d0c-b1dc-534d23af6920", "comment": "Malware payload", "value": "422e229b85ec22933e253a45e96c5f0941b451f116f7beefa8d40cca39e6fc97a23d3707a984d4a40fe41c83616e4f95", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688422, "uuid": "b6501eab-be5e-42d9-aef5-0b3133e5a1ff", "value": "T15F35E782676F24F7E9A7DE77D192F37B58B831942060EF18C940C5B828D395A1D3ACB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688422, "uuid": "fd89b712-2f55-4113-943b-94bfd74618c6", "value": "46284bdc41995f99c226de41d306d425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688422, "uuid": "6f690170-e3f4-4434-8e09-a2e861faea73", "value": "12288:iEuzvwHo+NndsBZrWvX2KMCFo1bGdwAfv:ixrwHHNndsBYJM8GAfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688422, "uuid": "780f590c-6daa-46b9-867e-3407ff411a0c", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688422, "uuid": "d85d56be-c8f0-49f1-baef-362718c9a59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688422, "uuid": "1d7bc897-e956-4137-ad11-f84a39884a53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664d7478-e196-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766669652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669652, "uuid": "639dc08c-6ea6-48f7-9080-78f43378e9e3", "comment": "Malware payload (Mirai)", "value": "603769c763c2c5b5973b5263ce192d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669652, "uuid": "10143fc7-a716-46ab-b37d-1655e71ae52e", "comment": "Malware payload (Mirai)", "value": "ee1a117c64a772b5acdf6c502013891165f1cc97e8e108a3b08138c7bc9cd5dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669652, "uuid": "48e22084-2a52-402b-b214-0a60c2b289a0", "comment": "Malware payload (Mirai)", "value": "b4abc475a9bcafa3b2ffb3096a04190de16c0664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669652, "uuid": "44e258a0-5f89-4206-bfc6-2858177e639f", "comment": "Malware payload (Mirai)", "value": "49b70b82148e355f31967c8a08427fab9e6b4a7461c3048fd227ec360bb6c54858550634e44b7a3975719ca16f205a1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669652, "uuid": "4b0d20d4-c9e2-4203-b418-041610dded92", "value": "T1F2A33A96B401CE7DF84BDBBA84170906F531A3614B930F3B626BFC636D321994D27E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669652, "uuid": "02953266-e4b8-43ae-81a1-8a84e377e175", "value": "1536:4UYD5booNSAJSAGw0TySr8/fR5HpM8Nx9e4G3QQ1Bb82On7vFu3bb:joNSyS1ikqfR5HpDG1x8habb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766669652, "uuid": "3014bda8-3053-4e94-adac-d0ced312ce76", "value": 98604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766669652, "uuid": "4b742e8d-4bb1-43ca-b46a-7cf444b1da37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669652, "uuid": "86663c76-2adc-4fa6-910c-4acd64e916a7", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdd46b3-e124-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766620806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766620806, "uuid": "8363811c-4ea4-4c7b-88ac-fcf8c1379756", "comment": "Malware payload", "value": "1687dc6f882a8d889918aebc0b6664b7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766620806, "uuid": "11f0dda4-45cc-4fa4-9c79-0cf9c88e2676", "comment": "Malware payload", "value": "ee6aaf5f7f8d7bfaa63a942f3dff98d6990f2e8aa311cfbcb3487773bb786887", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766620806, "uuid": "f0432ca2-54eb-4e7d-983e-e2b1b35e34ca", "comment": "Malware payload", "value": "0719f2cb1674e1d2a4d76bf895e5520333bf88e8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766620806, "uuid": "5afc4896-b5e2-4b86-8536-8575419a29cd", "comment": "Malware payload", "value": "1d36eaa1e50d409d717fc70090d16454ced4d8956f5ff36865740f0120c55168a1ed3cadbe47ba77643cecb47ae0e18a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766620806, "uuid": "fa67bc4e-877e-4929-b0df-0d7b62a2f532", "value": "T137E1C696ACF32419741B506DCBBEE25830659057874ACD9CFECC75A8DF0C2A49622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766620806, "uuid": "ca175126-e89b-4164-bec5-31840f80a11c", "value": "192:OZLy1IE/CTK/eYF0llHYoHsfOBro2Tc/O+Smy:O9O/KYoHsfO2/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766620806, "uuid": "42434037-3553-41e0-aab1-59f2d0db1f1a", "value": 7373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766620806, "uuid": "b49a686d-7cde-4198-9d35-6d57f29f4569", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766620806, "uuid": "d99d114d-fd11-4b34-a521-2b66c15c4a1b", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c392916-e178-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766656697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656697, "uuid": "848d8ac7-7275-432f-80f8-8427ebd64787", "comment": "Malware payload", "value": "e8f731797aa24113a82ed989944b4370", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656697, "uuid": "ec6519bc-21b6-4b8f-97f8-d420379b3ff9", "comment": "Malware payload", "value": "ee8a417c0f8b854d1e541e78d75855507ceb08eec8427860d5562a84c6151120", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656697, "uuid": "4169e955-f813-44d5-9b75-25c85fe1ca2e", "comment": "Malware payload", "value": "42e9479734dfac3e0234fb47c35377ea974c8a28", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766656697, "uuid": "4c0e625a-04c4-4474-be42-78f9f4199805", "comment": "Malware payload", "value": "b19f7780dada4e82ff212d77cbbe018dfc873dfe9bffcd96ba708b58de107924b076ffd6d1158aa48645457b76879374", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656697, "uuid": "1f96671e-c42f-4e3d-9e1a-6dd0135d9ba2", "value": "T1A7119DD921D0882A44EACC4C32A48828963BD5C579418F7CDDBD44B741E6AFCBF2CE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656697, "uuid": "e32ebea6-e86e-4f85-b865-69000ee842ee", "value": "12:poV3XZjNIBS+TQoKSrTjxHXleM8brl9AXYl9oVHTxyaPF6wHhyrQbk:pgFNII0KSr5358/l9Aq98XLOQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766656697, "uuid": "b38826ef-af4a-4e7b-b6a5-0bcb0726d861", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766656697, "uuid": "e491b385-4577-417b-bc64-433b39779f91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766656697, "uuid": "46fea86c-ff18-440e-8be0-17b3ee0878ff", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7414b8b3-e1ca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766692009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766692009, "uuid": "791e0a1b-37e0-45b6-b757-a637bdb43f2a", "comment": "Malware payload", "value": "99a9f0c8bb96ddc06fd6cce697dcf783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766692009, "uuid": "7a4cd8f8-ab70-4491-a9f8-f183dd31edf7", "comment": "Malware payload", "value": "ee9b3cbcb3538dc43fd7452ccce4d0155fa443aa62e9c03380407fcf3b532a08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766692009, "uuid": "54772da1-1361-4a4d-9c42-39370ff86481", "comment": "Malware payload", "value": "2d7575ec28d855ade5f8afacbb6c12c561ea94a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766692009, "uuid": "8b2dcf0f-b1d0-4b59-bd5d-8992725c1e9a", "comment": "Malware payload", "value": "a125429fbc87cc9c3febdee46721dfa645fb9f39ef446811f5776de32a64f6d021208344708b1d58472017bfed250349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766692009, "uuid": "9a636901-4a8a-4c16-8ea0-ae37f890bf45", "value": "T1AD64236384530E6EFBC132BE991811C7E39039B50D3DD65959FE8BBC48921B5A9DCE30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766692009, "uuid": "f8f7f37e-f1ce-4ea1-939f-3094fbcc74fe", "value": "6144:ju//HKcG2wchSnsUNMzdaCCDUox55Qw8wRe8VoxI20cU01zUN1/OkhGuOXent:jEKT2wcEt0JCgox5Kzme8GxVvUfvhGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766692009, "uuid": "a0c225ac-a404-467b-a429-a9a55864236b", "value": 327420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766692009, "uuid": "bdbb1a5a-c251-4c4a-b572-dc8534463c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766692009, "uuid": "bb1109c1-992e-4ab1-b899-72f51c2a35df", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47afaafa-e168-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766649844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649844, "uuid": "4e57f582-3432-40b1-8519-92d3c33479b2", "comment": "Malware payload (Gafgyt)", "value": "6338f7d2a747a1d03c16793a90123f1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649844, "uuid": "00db12f4-e1d3-49e1-a654-8fab612261f3", "comment": "Malware payload (Gafgyt)", "value": "ef4953e007c080c371031a968ece2364114b10ab2dfee916498aa1f7a6f224cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649844, "uuid": "0396da17-c970-4cc0-916d-de6a32a96114", "comment": "Malware payload (Gafgyt)", "value": "dc46f234cd3e9db1bffd6d04d2c2af96f470d95f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766649844, "uuid": "1e9e5b4a-ed4f-4415-9b15-44dd2a1b36de", "comment": "Malware payload (Gafgyt)", "value": "03e177f88dd0772757981e6f701e84e70b39c224f39bf261756248b5e7ebce396db9bcf1117263803fd5f2dcfe54e14d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649844, "uuid": "d443fec7-8603-4ae7-897c-a5c6fdec88fc", "value": "T1E7D30905D4508B23C2D2677AFF9E474F37225BA89B9B332256296EB02FC179D2E3D510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649844, "uuid": "574a6331-ad23-4f59-8da7-731f533dee4c", "value": "3072:4Bupxw7bIfTzhmjaF8E1NaFoOtZjqQGxHolZOP5hEg2UgDQHHe8emyhQaS+pg7J:4S6E1NaFoOHJOP5hEg2Oe8emyhQaSGgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766649844, "uuid": "4872ed7b-40c6-4c35-a271-dbbc9555468f", "value": 138870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766649844, "uuid": "1a7ceb31-6d12-4c94-92d2-6ec2261190bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766649844, "uuid": "d8c309dd-ee0f-45fd-a03e-4d0c0c4a5489", "value": "i.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335548f1-e1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766694048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694048, "uuid": "8f9a5f52-bf73-4c81-bacc-dc5f221cd08b", "comment": "Malware payload (Vidar)", "value": "cf0a119aa90c4caabea0b310d68a15e8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694048, "uuid": "693f66d2-63ef-4b38-811e-e3b96dbb68d5", "comment": "Malware payload (Vidar)", "value": "ef6ce6a5f34ab55e4898cb9b895d9832d66f0b0c3757a4e446b42cf6967f7da8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694048, "uuid": "ac6d0770-e94d-4512-a946-0b714013bea2", "comment": "Malware payload (Vidar)", "value": "8fc18735404940ae47cddfaeb1d5259bcb6de7e8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766694048, "uuid": "3ab85279-76a3-487f-b4bf-9aadafa75a01", "comment": "Malware payload (Vidar)", "value": "b8f5a3db88e5d8e7d5d4d8dc07124461ebe19c28db04401cf072f199732d918ce880c76b99cf7b65154cbb728877750e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694048, "uuid": "33f3d04e-0243-4181-b8f7-69ebac7d3970", "value": "T154141334A5E6F254C633B13D86DF22687546FD26F1A0D51B7BCB2CA78F0849E53863A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694048, "uuid": "9f66b726-a362-4805-bb39-5a9386aae52b", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694048, "uuid": "c2b3b7d3-abab-4c0c-9608-8e4df65b641b", "value": "6144:qcz5nwjsumtpUz0npGn1KJ1eNY8QXPTZrrMZ:qAnw8tpjnpGnkbOpQXlXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766694048, "uuid": "d9e77813-a055-4bff-9199-8733abd7b2a6", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766694048, "uuid": "016c719c-fa5f-4441-826f-8dcadaf592d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766694048, "uuid": "95fddf9b-27dd-427c-9ca0-cfdaa398f12f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c617df-e1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766676421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766676421, "uuid": "dff180c8-c23f-4804-9437-8f2519f0f15a", "comment": "Malware payload", "value": "e9e8bcb1db915c26fcaa3485b4dcc3e3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766676421, "uuid": "ac896326-1e00-430f-bf34-f94b6db706ba", "comment": "Malware payload", "value": "efdbec2afdac78bf64bc6d859aceafbe684dc5aea6a85f96297572a815a176da", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766676421, "uuid": "dfbde4a4-32c5-466a-a6ba-dc0b5e00db63", "comment": "Malware payload", "value": "c638032285fd7a8f95b6e0340c9142d6195a2ee9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766676421, "uuid": "02d5160d-cec3-447a-8f16-d922c0d0e152", "comment": "Malware payload", "value": "6a6051453e8b3bff9c4ff288748d5a429c4fdbcefc79d499e277aa4190d59442c6066dfa9f073f7c30edeb4aa041a56e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766676421, "uuid": "d199ca4a-bd15-4ebe-8790-be0813850309", "value": "T1D296124063F4C067F9F68B784AF29593DA30BC614A7787AF9988911D9A323C0DD31B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766676421, "uuid": "292378ba-2892-4cfe-8f6d-4d9aaa1e290f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766676421, "uuid": "932f298c-8f4a-4a6a-a856-c8539f9706f2", "value": "24576:Y5SIJ5wKwxOuNWLKBNlf0u3IFBW7JUOhoACHAzYI0wSTL0l10sv+FVcBiHRD8Iq7:+J5sr9Y0JEwSnwlW33HRZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766676421, "uuid": "2eb49b93-86a3-4cdb-81cb-f0bd8a82611b", "value": 9446952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766676421, "uuid": "94784cd9-a4e6-443b-bb99-bac873f70531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766676421, "uuid": "75551da5-bda6-4ee6-a78b-c8f975c0f3ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c0f396-e19a-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766671211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766671211, "uuid": "1c9255b5-3625-481b-b66d-6fd9a0d21b31", "comment": "Malware payload (ValleyRAT)", "value": "462604267b395dbaab27f28dae6ef9f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766671211, "uuid": "b3c7c6c4-3462-4261-a023-0277aa2d417b", "comment": "Malware payload (ValleyRAT)", "value": "f0138e6a4095c699a1db0af0d1f42fab5f60b4660b031b8db5e78fb766c6adcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766671211, "uuid": "661acc1e-4211-4ec0-9b14-c3f3c448c98b", "comment": "Malware payload (ValleyRAT)", "value": "bde7d5e9ac5beecb0c18bc5dadbbbd1f82c533d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766671211, "uuid": "fe50e4b2-d8b0-48c2-a713-fd8116546fd3", "comment": "Malware payload (ValleyRAT)", "value": "7f15266a22bd807242de11f5f6dc92b68b632c44dc31b7d2ff4ef87001299b42df1b705dd4f61013d25a08b518864901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766671211, "uuid": "f81e64d0-217e-41b6-abe6-11b5b556476e", "value": "T19F05CF51779188F1EDB7113649249A56DA3ABC110B70D6EF23D8077E8F332C1AE3AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766671211, "uuid": "ec51ec2a-a12c-444a-81e6-93776de03abe", "value": "b1f81f2e0d241db4783f72418d9096ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766671211, "uuid": "64c289a1-f0c0-487c-92a6-e9dfede98ae8", "value": "12288:1PvLOJgV+IoRoRdAQN08YcbN8h1JFyZD2hho9V1I5HuCRI2trmMm79iDSqgQOJUi:hjRVsRud7luh0Yg8uCRI2lmaZgCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766671211, "uuid": "25aa79d4-3c71-420f-bd5c-efb1dba7cf2f", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766671211, "uuid": "0e00654f-8f9e-4dde-8156-28459e5fdf03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766671211, "uuid": "a4356435-b8de-4bd4-b42e-2665691eade0", "value": "f0138e6a4095c699a1db0af0d1f42fab5f60b4660b031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3952f4c4-e1bd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766686327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686327, "uuid": "9e17a275-15f4-40ed-9c58-109981d98261", "comment": "Malware payload", "value": "af3d3fc1fc57ebe0720b2b99c8c94f26", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686327, "uuid": "66206322-101a-439e-a50c-d9a8cbc35447", "comment": "Malware payload", "value": "f013b00c70953fc29cf43ca3aee4510d0f8ff48347010cf43966854222f465a0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686327, "uuid": "e11d5493-432b-4bb4-ae0b-cbe3f39495b4", "comment": "Malware payload", "value": "fb5fde985523ba948feab93e98995a8e77652d0d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766686327, "uuid": "b31dd0a6-73ce-4f3c-8328-20da37836fb7", "comment": "Malware payload", "value": "cbae331fa5e95723d98aa54f307c52fa556238663cbc2b17dba242d2003e02db1ff2eecca452765383fc4449f8e54875", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686327, "uuid": "01e89768-0a7c-4b10-998a-f0f70fa3cab6", "value": "T12FB17E7DB7CC1498EE19C443E1EA10125E0FEE2251AD8E7E210ED5354DE8ABDC0B41AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686327, "uuid": "1321babd-0453-4439-bbf9-1820b726f46f", "value": "96:ZS1cuuiSxqnGhIKv2TOJcBX4DDlC5kEQoRB4grFhTd4bv3KpufjUSliQu7Zn4:lImrJIhQoTrHTyffDl3u7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766686327, "uuid": "295011f2-4671-47f9-8684-6ff7047e2e19", "value": 5310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766686327, "uuid": "4cba9c66-9156-4148-bb19-379036ce19f4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766686327, "uuid": "24cdf617-1668-4e73-8ea1-e404dd92323b", "value": "4_18_2_1955_25.12.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99c0ed1-e19d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672906, "uuid": "e323acaa-4219-4c7a-8aae-c7b8efece793", "comment": "Malware payload", "value": "ab8754842b3c48befcffa3deb3d58615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672906, "uuid": "00e3c710-303c-4318-885a-34180964ad07", "comment": "Malware payload", "value": "f07a853f65fbf3196d3b4a227b4070b8a3e136ab1105e17ac2e9b7f9578aca01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672906, "uuid": "634a3b59-5b25-4a6f-9a10-3dbed7eb2b55", "comment": "Malware payload", "value": "f254311cabf3de505fc7f685cc0745d610c62331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672906, "uuid": "6c590fec-d232-46e1-93e3-5f5eb42c33ac", "comment": "Malware payload", "value": "9042ceaa6821890c1b1a09e9e840f66e06a82d45dc635dda6c504dd83eaa7814fca673f878191f95e5171fb8e6d68c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672906, "uuid": "130366ed-b567-41b0-8d84-123a9e494b04", "value": "T147A7CE26B50CD8A9F6B60AB1D91275AD4C773FF06B125483FD9036AF1B37690E9381C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672906, "uuid": "dadbbaa3-a8fa-416c-9802-51b276b93eed", "value": "d7e432b31a2364cbf33d4eb1b92d3b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672906, "uuid": "6b621827-6ff9-4a55-a682-9ad16f86c3ba", "value": "786432:6+hRxqqtAyy8rDmc0UcOCpTqO9m9yuPmlszm:6+hRrCCAPTqO9uPyQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672906, "uuid": "e0794fbc-7240-4456-b9aa-a62178937baa", "value": 44702079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672906, "uuid": "e2402c9f-cfbc-4200-94d7-a93a2e576e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672906, "uuid": "ba753256-79c5-41fe-9a6f-ed7c85be4265", "value": "SecuriteInfo.com.Trojan.Win32.VMProtect.27681.4703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2457ad0b-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766672977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672977, "uuid": "7f30e167-14a8-49f5-ae0e-8ebea1af69f9", "comment": "Malware payload (Formbook)", "value": "ec4790a7de40c50df0d00e499ceca81c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672977, "uuid": "9f6d3177-ac57-49d3-aafc-c8e31e0ab292", "comment": "Malware payload (Formbook)", "value": "f2068b503c0bd84e39c0b6d9606939709768a8f906488d6808373c94f4cf73ee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672977, "uuid": "4c62c8ef-2feb-4887-94b9-8a515c9fb812", "comment": "Malware payload (Formbook)", "value": "1abb1dc95d883a74442b228e1c36435593a520a8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672977, "uuid": "0d64dc02-ea12-491b-8178-1465f429f1e6", "comment": "Malware payload (Formbook)", "value": "965584985c6206e8ceca71c4dbe817cf52c69a2d3c32786ff205bd698d8792b4ef3eb40d54490cd05eeed73092131600", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672977, "uuid": "0285c833-27a7-43ff-bc41-05040abc313c", "value": "T19313B8CC3FC7B06493512063192FA09AFA1E4C44768C44A1E76759E4F96C728FB7AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672977, "uuid": "9d8fab50-5cf5-4501-94be-8995925e750e", "value": "768:4iuG+ux2GP550h74gBsG+na3vVX6rx987KsxzU4W59PcsEwnQ7fxRBL:4iu1Zo0h74gCAR6rx9xsBJW8AQNRBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672977, "uuid": "8c5a4893-ed55-4bae-8b8c-20ca7b0024a8", "value": 43006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672977, "uuid": "2934956a-4287-4cf5-a207-8e622385d0c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672977, "uuid": "c7282673-b9c8-4c5d-baf5-0e79a667ee39", "value": "PO_29302-MCOP.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14501222-e15a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766643745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643745, "uuid": "94ffae97-401c-42f1-9ad0-d58f5b74e868", "comment": "Malware payload (Mirai)", "value": "424f644abb9ded22754feb3b9abf5c2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643745, "uuid": "e48b6027-143e-4dae-83b5-c95077c50ee9", "comment": "Malware payload (Mirai)", "value": "f37da94b599b185bb6373cc59a252a45e1ea595a217bc451914bc4d42c778efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643745, "uuid": "362e0f83-4b6b-47f2-808b-b4f6f8dc00c4", "comment": "Malware payload (Mirai)", "value": "1b241a91cec4cb5b7afe6b98fea466140e86f069", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766643745, "uuid": "f2cc21b1-f03e-4018-9eea-bb414dab186e", "comment": "Malware payload (Mirai)", "value": "7ac691a0bcc02756f3d71a7c6b3f43c38bc22871e43912fd1883333543b5b9f9125305df712d59666050bd0ed252447a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643745, "uuid": "d6efc326-a495-4193-aa48-247fd6183c55", "value": "T1E8839E73C83AAEA0D1598638F9B18E785B53E40481171EFB5AD5C6AB4043EECF55A3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643745, "uuid": "4012a14d-70e4-49ab-8d52-2cfd2f5cd225", "value": "1536:p/dCc2sa/i2hiwt3LFYdedlJvb5ItQY+LsJKIg5qCQ4JBCtBtl:plVTjv4LDd3RswIwQ4JBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766643745, "uuid": "724f9e48-5afb-49a7-bb47-38ea2d2ed94b", "value": 84664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766643745, "uuid": "3e2ee541-3bd7-4462-9327-2eb860eb8280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766643745, "uuid": "cb494d44-3b4e-4ebc-880a-c1af5bce087a", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa27037-e1b0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766680835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680835, "uuid": "4335cf35-bbd5-439d-b807-14cd4d0acc82", "comment": "Malware payload", "value": "38611031e21eb5f0c629e59f1e8ca16b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680835, "uuid": "c3f57ed1-e2e7-4f2b-8df8-cc94fd1be5c5", "comment": "Malware payload", "value": "f3d0cba26ea9f9102d62c0985ad56818052334f08479be4536adeccd2b584be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680835, "uuid": "37a885b0-859b-4661-831d-e4aa569ce302", "comment": "Malware payload", "value": "6b48f28268bcb5c5fc65c7fc5042a8c5e7fc88f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766680835, "uuid": "e834b70f-3868-4542-a1cb-3c4849feef76", "comment": "Malware payload", "value": "8040839013bc1164831cc7039187ab8b9df58be8718769c96065db1bd9c5bcd3e20875fc29a759ec31bcc61bea013243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680835, "uuid": "aa02d78f-9e4c-41db-b8cb-e3ee0b2e5da7", "value": "T10F47D9BB4E384D89C6C7F1F69381D6700DE69EA6E8E6E0FA51E109401F433506F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680835, "uuid": "9d040828-bf12-4959-9861-40f86d5756cd", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680835, "uuid": "45713909-5fe7-4321-810f-26ebf5e2be7f", "value": "49152:RJa9KU1naoQeKuReJDAIknW5lsmAbs6EaZhQU8IoGPNpWt8Tl3s1fIGgs9YM6VsA:5eiI7yveUIqUUuRRduSvtsiv8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766680835, "uuid": "0e95a8b8-68a7-4839-a7d1-3dc1293084ab", "value": 26715648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766680835, "uuid": "94e0d3f9-3663-442d-8815-8f0b837a74d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766680835, "uuid": "b6715a82-05ba-42ee-ac08-5c26f0a1079c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb379af-e1c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766688695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688695, "uuid": "81432037-f597-42b5-b263-16386aed4a64", "comment": "Malware payload (Mirai)", "value": "ec923b877178edf97ae80ac782a1c411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688695, "uuid": "f09351ac-e1db-4044-9695-d4b0b9cd2ff7", "comment": "Malware payload (Mirai)", "value": "f3ea351bc4fda2381d2bb94d264dc023ccca41c9082611ca8f7c186d293589de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688695, "uuid": "94136a93-0b1d-4275-a59b-4f1f60a6b4ec", "comment": "Malware payload (Mirai)", "value": "c3a01369a9881dfcf7756d8d148190f170d0773e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766688695, "uuid": "8f153d42-af49-4ccc-ae86-a6e018609df9", "comment": "Malware payload (Mirai)", "value": "a787b2a9d083aae3846de1ec8fe67db2f80e7da20edd43bea3e6d6a1ca4df33d134eee1fe6245000bc1c5bfa9d79d895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688695, "uuid": "5f6896f2-cd9c-421c-9985-df13e7ab7737", "value": "T15EA32956BC818A12C9D513BAFE1E118E331353BCE2EE7212DD105F24778A96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688695, "uuid": "79f5d9be-65e3-452f-b691-4ff854713a10", "value": "3072:N9eAo+RhAuvnBczK8kZTybAZeDbjaPYYksYPR:N9jTR+cBczK8qTycZo/aJYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766688695, "uuid": "1c6f8578-e775-48db-9c19-d2cd7ca8064b", "value": 103732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766688695, "uuid": "b1c7624b-727b-4ab0-88fd-930df63e73a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766688695, "uuid": "a91d2058-222c-478d-a0cb-ac2c8b24e4b2", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e2bd0f-e1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706024, "uuid": "9cfe6581-0fb3-40b8-a184-3929db2726bb", "comment": "Malware payload (Mirai)", "value": "b1f57429659ed5e7f6d831f3e1bad353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706024, "uuid": "44124e68-90db-4752-9c29-7f636561b0fc", "comment": "Malware payload (Mirai)", "value": "f4a6c1a9aa3e739fa65c323062d695f8533b803ef1d0e064933668c8e8366a9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706024, "uuid": "168f7dd0-51d1-4036-9d24-2275a19dd1a4", "comment": "Malware payload (Mirai)", "value": "c4509ced49a612a5f78b9012fc9c892639dd4667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706024, "uuid": "57924bde-d7a6-48a4-abbb-5fa4095f23a1", "comment": "Malware payload (Mirai)", "value": "1d1c821fee3490a49c4ec8f0400d61ff5477677aacc9c7941c5f13a29ed48f271a53be7dde88df839300c297a2269a00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706024, "uuid": "17afa355-66cc-4eee-971b-91ce63de8e7e", "value": "T1E8632A326639AEA2D5C1747932BB631A75F152EE86B8D82CFC312F0DFF228549107572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706024, "uuid": "bcf806d4-75a7-4cbb-9edf-8c2c254c23de", "value": "768:KFIgKMcYZ96CANeOEGE1KeS55misOQqsEO+MpEE2XP4:KFIg3n9ANeOERKbHmiFQqse+j2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706024, "uuid": "dd847131-f0c5-4c30-900c-ddce9328c67d", "value": 71052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706024, "uuid": "20e77cf9-13cf-44af-a693-145f0af79938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706024, "uuid": "b80ad0b2-c50e-4415-a09b-770542077e9e", "value": "shadow.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dd5289-e15c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766644819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644819, "uuid": "ff1b33cb-cf09-4802-a7ea-fb18364b73b2", "comment": "Malware payload (Mirai)", "value": "7c43860b1d72a977e593a755bcb00842", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644819, "uuid": "95bfbcd7-a4ea-4489-bcf6-a18ed8c9a186", "comment": "Malware payload (Mirai)", "value": "f4e4604bcf40e4bec7c195773ce07156457bc5d858f5a734d086d69f07ab0c91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644819, "uuid": "25e5868a-8703-4449-a9e6-15a01d3c0076", "comment": "Malware payload (Mirai)", "value": "529616d784cd898a09b777ca7f018c9fa7f29cb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644819, "uuid": "9321ab6f-1852-454b-b152-7dd7d4e7b108", "comment": "Malware payload (Mirai)", "value": "3adfcc88c40e5f3b972bbc40b35e1e11705a5f9a34503a379d921d9a786fe4e2b7321c322c5d15a19ca44af55ab4777c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644819, "uuid": "ef529141-24a0-4aa6-820e-10aebf9bd72a", "value": "T11324F947B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644819, "uuid": "0b6aa07f-c4a6-4917-a75f-fe99299f0948", "value": "6144:Iv4nw6IdA1Twfl4ds0aVGGp8CwZ9YNJmh0jmP2:IEwi1Talz0aVEHZ9gmujm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766644819, "uuid": "7f2956d5-d17d-4213-acd8-7d5f3f9104af", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766644819, "uuid": "0e4b4ae0-1a06-4c68-ac2d-109e3a10a1c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644819, "uuid": "f37cc222-7fee-421b-8c7e-686a5fd6d937", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99f8fa7-e19e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766673308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673308, "uuid": "a605edd2-b04b-4e58-89bf-77d7c4afcfde", "comment": "Malware payload", "value": "75e6f9aade3e0c2621c0d37c8f61f48e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673308, "uuid": "a2900cb0-1f8d-4bd6-ac29-5e948b4c02e3", "comment": "Malware payload", "value": "f57802a66fe0fcce0d13e32793ecd3487ca5996f7341cf0464c0e1d10291e1f6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673308, "uuid": "7d772fd7-65dc-4e5d-b3d3-3eb289da7c3f", "comment": "Malware payload", "value": "99840e58360b9c25908763d00cf0510188671427", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766673308, "uuid": "7ec0b3e6-a033-4a78-83ae-376e3c66c87f", "comment": "Malware payload", "value": "d0c175c2362b957c997091a154e9459c67a4f85d17befe1ac6b829459c85e82f1141a076d88d23b8567ead9136d625cc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673308, "uuid": "eb14c2a0-c37f-411c-ba90-2cefcd14ed39", "value": "T1DCF422986CB8871DAF1F783BF915A021F00E9CFD44B1DE7AB86C3692D7578210069EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673308, "uuid": "fb3b3bb0-edcf-4030-8b08-f59f4efa4927", "value": "192:9p51r6sqa6/Oib5VZmbknyjqNkOsPRGlRDF88r:3xqa671pNFwRGlRDF88r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766673308, "uuid": "b1bce48e-5662-48a2-9ad3-25be9a089ee7", "value": 727826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766673308, "uuid": "c8f4542f-da67-414e-9b0e-60a26638ea4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766673308, "uuid": "c932875c-e9cb-498d-b23d-15d179763147", "value": "CWP2026-NH PURCHASE INQUIRY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a22f014-e132-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626682, "uuid": "d5747114-2e75-478c-ac88-e7c0ceb897de", "comment": "Malware payload (Mirai)", "value": "07af4703d2b8f0891b429730a6f2ea91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626682, "uuid": "8d41719d-2155-4f9b-84f9-21e220acaa5b", "comment": "Malware payload (Mirai)", "value": "f5ae6aafdf57b5a8f6ffdea7823ed77d77ac0af1c1a38bfc7ba3d21806ba224b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626682, "uuid": "fbbe2933-f7b6-4028-8eba-a491613cafea", "comment": "Malware payload (Mirai)", "value": "a2829c4fe205cac15be1cdaa842490e7da70edd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626682, "uuid": "8fa68a4e-0e64-440b-a1bc-9ab37d371136", "comment": "Malware payload (Mirai)", "value": "3883d9cabb242b79935fa4efc9619ca0fc3865b154b09cc5aeb7c7ab5fbdb28e51007352fd5a3ffd7022b20ff63f1172", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626682, "uuid": "d9c9458e-cad9-4263-b54d-5f16a0412ba3", "value": "T1F373A44E7E629FBDF62C873543B74A30E75523D222F1C685D26CE5041E6034DA86FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626682, "uuid": "e5be4d8e-12da-499d-beca-281b4fe81839", "value": "1536:uwUKg/OciFqWgoustaB3iBVriBBjgZsB5LdTuhyBJTwt:IT45aLjBJT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626682, "uuid": "a5536544-2522-4c55-81eb-77627281def3", "value": 76580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626682, "uuid": "3f980bd4-bf95-4e50-ab8f-8688dd0eabf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626682, "uuid": "f99224d7-edd5-4f94-b184-1a456287b6f0", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3490283c-e1c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766691044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691044, "uuid": "f66e7dec-649f-4840-9867-ae99d72b068e", "comment": "Malware payload (Mirai)", "value": "c4caa8a91dd70c39fe29bbd2940c6846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691044, "uuid": "fdefcdee-1be9-45f4-9f87-45939062825e", "comment": "Malware payload (Mirai)", "value": "f6f6de25b4571bb52686079373295c4472c6cd463f26fb8078189bbf852b9091", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691044, "uuid": "0f016e66-7f48-4fc3-a561-763bd6ed9ee9", "comment": "Malware payload (Mirai)", "value": "89f6d37b77a889127115ace4d00590feab4c512d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766691044, "uuid": "9c5012d1-de02-4005-b697-8cbe7ed59cb5", "comment": "Malware payload (Mirai)", "value": "a983e77bf2ee8c8eeb119eb8a93901a430bddbe00764a141c6ff4acd14588b19c5a08cf26451479c4a0640d5ab031947", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691044, "uuid": "81199ba5-f4c9-4026-bea6-ad6d1946747a", "value": "T19A936B22BD792E27C5D4A57B22F38324F2F1478E25A8CA1E3D710E4EFF2561022576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691044, "uuid": "80fa7863-015d-4938-9958-37a0269735fa", "value": "1536:UfRUrdxIuqHSEiJPE3vv1wtDyxlufd9K7QDtjVYl5KNt0sDg:UuSmlGMDulul9v1VYXKxDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766691044, "uuid": "f55dad97-1398-4c74-ac78-6cd4d47a5d8f", "value": 96080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766691044, "uuid": "11a997d1-5ab1-4d02-b68e-e94dde0bd433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766691044, "uuid": "8f8c07c7-630f-4e0f-ac04-d251962e2a82", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba48904-e15f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766646227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646227, "uuid": "fc87d602-9044-4b70-9933-f0767ea629e3", "comment": "Malware payload (Mirai)", "value": "23327de9fff8fa659015e293f6230c1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646227, "uuid": "0ac3e84e-d50f-4ec7-9199-ad2ffd91d83b", "comment": "Malware payload (Mirai)", "value": "f760aa0003757d0bf07080056ba4475707b398f0f21a3d5aeeb0561e236554ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646227, "uuid": "353e8da4-5c98-4dbb-99eb-cbdca204ca23", "comment": "Malware payload (Mirai)", "value": "3cae7bccaaef4f35680a2e2f11aa463d632a9ed0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766646227, "uuid": "ba0dc1ad-468d-44d9-b1fd-02a687f05ccd", "comment": "Malware payload (Mirai)", "value": "f6f84c850e81795652c5a25e7bde96c1fbd3c15978f3a968fc7a20f29d0d93b7ed00b8db10e320dbb1a50c989cee1104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646227, "uuid": "4e9f8a3c-da49-4b82-94b6-86dbaa3e4d5d", "value": "T10C931A56BC818A12C9D413BAFA2E118E3313577CE2DE7312DD106F24778A96F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646227, "uuid": "2045be9c-244c-44a1-ba78-e7f4f04e5163", "value": "1536:GpnB5I0JeQSCIasYPvp7nZgdD+dczKNe1AzU5QzvQaEVVE2RGdpRiQnVilYC:W5FzIaBBDZsDMczKQiUSDQaEgnVilh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766646227, "uuid": "156a5660-7fd9-47cd-92ca-ecddc0f872a8", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766646227, "uuid": "d6de38b7-ef56-475d-8a43-4edb5bf37339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766646227, "uuid": "501fba80-4ac5-4edd-b576-9651218f8cb4", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8fbc37-e154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766641480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641480, "uuid": "ea1543d9-7c56-445a-bf86-20eb5df6d05d", "comment": "Malware payload", "value": "cf2d54b53b63904caebf63c153974ed1", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641480, "uuid": "74dcddb0-f282-4edc-88d9-e968e513fc4b", "comment": "Malware payload", "value": "f79c06795ae5144703e4e4d14424f944f26625e77ec20c802fa3ca47cc4659bf", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641480, "uuid": "460153c3-e454-44bf-a77f-e01d5ff79021", "comment": "Malware payload", "value": "068a5f5f7cca111bc3a7a59e6ea5a57ff6c17447", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641480, "uuid": "1a5f9410-cc79-4a6c-ba6b-89a1de7f02d7", "comment": "Malware payload", "value": "1f30d5328ced8501b77d7c11808238fbcdfa358b917aedb9839647e29e0e070acdb3f1971df44f94ada614ded4f7a54d", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641480, "uuid": "f21ae8d4-b980-4497-a8ca-d429ac603b9b", "value": "T17841B5701F55CB9D02C1A0BA667AE5498B708E422142FE9DEED6D350C40B3A4D6FE289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641480, "uuid": "355dbd9d-4f17-46f1-a99e-c66e850f8fb1", "value": "48:xBWysVT/H3xuAF2JYX5kic3lu5vcxyRw+RORvB3vB3Tw1Aka134yGkFa1T:3WT/XckwqJwhB/BD2goy4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641480, "uuid": "debf2d19-ca3b-4186-b545-e7f869657787", "value": 2112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641480, "uuid": "ee8d6f6d-ad1d-47d0-9ac7-7235e5d06034", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641480, "uuid": "d56362a5-d284-4f7c-be4b-93622f124a1e", "value": "f79c06795ae5144703e4e4d14424f944f26625e77ec20c802fa3ca47cc4659bf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5d5b0d-e15b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766644540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644540, "uuid": "63c87d88-928b-4982-a8db-0aec53d20063", "comment": "Malware payload (Mirai)", "value": "78341d7c7d5ad77f667f8b282ff6a5db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644540, "uuid": "dc385e2c-bcfc-4df8-a718-6ed3fb847a54", "comment": "Malware payload (Mirai)", "value": "f8457bcce4417abca94ccf4e9ffc01e51647a8cd02f8f21d5608419bc3b8d26e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644540, "uuid": "de194c8b-0983-4883-a8db-8850c4f79661", "comment": "Malware payload (Mirai)", "value": "f278e7cfaaa3916e2d08dfded796058f6000320f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766644540, "uuid": "50c64d86-cdb7-4300-9a7d-55487be91db4", "comment": "Malware payload (Mirai)", "value": "439e4fb79f05584adb6c2e441a293c77d2037fe113d2631d9b664da03177461e0674f436c8375fea933cee5fa1d093bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644540, "uuid": "c7063b8c-8e3b-4b92-9164-a2a9117958d4", "value": "T1BAA31851BC929612C6D423B6FA6E018D332663E8D2EF3213CD216F25378A96F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644540, "uuid": "9ef19c63-57f8-41ff-9a09-a4743e0ef115", "value": "1536:Xz8I9gU3bc1JxLEsI75UP7Oh23JPZlABbfxIaF8NtMrkW65JtOoFagYOXUo4avGB:Xz8sgU3bc1AsI2EtL6Ork7Ooc9OkuGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766644540, "uuid": "0cd77154-8fb7-41e6-bbf8-a9bd10ca7085", "value": 99640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766644540, "uuid": "82b9bda6-78af-4577-9ce7-ed6f6112a2d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766644540, "uuid": "8258b9b8-4b2f-4ddf-9cf6-7ee73c1bd602", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08665848-e18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766665200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665200, "uuid": "0dbe2464-7219-4106-b38e-471865a90c02", "comment": "Malware payload (Mirai)", "value": "377699ce536a7e0674441899962ecc26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665200, "uuid": "15792cf9-36d9-4457-8c74-560dcb52f41a", "comment": "Malware payload (Mirai)", "value": "f869caf0f78aa7b0e4f169fe9a6b0b62d9a8507655872230a62420461083bd90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665200, "uuid": "8442e539-6fc8-4ecc-b59d-db4c09b99dbf", "comment": "Malware payload (Mirai)", "value": "dce7effc4c1172ef76863a558a36e54174d754d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766665200, "uuid": "24ebcf14-3cf9-47ea-908b-eb09d477daf7", "comment": "Malware payload (Mirai)", "value": "2782a0da9c93b1166bb25a79f940e5e3e033fc071e66b4aaf92875e7114c449d2a132446dcd5a146cd8eb31b6e6bd0a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665200, "uuid": "760ee323-bd44-4f8c-b395-2c72a18abccc", "value": "T198258D2AB2B2F6BCD007C03447DBCAA14531F0756A312D7B32C4DA393EA6DE51759B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665200, "uuid": "f8c6e974-246d-483d-b407-19a29cb45452", "value": "12288:V0F3TtbbWNgKD6gub7a/FdiHX9fsvpKuhTBW0JXSkVc8pN7MAayfGbodHXHAx6Qs:yF3JWNg0U7apUmikVcw7KE9k6Qgc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766665200, "uuid": "9f6bdcae-1fd0-42a7-8da8-2c6d18342b7a", "value": 1044144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766665200, "uuid": "69bba65a-4f23-4fb9-ba4c-b24bb94f5077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766665200, "uuid": "2585680c-42ce-4c10-8aa2-6ea62bdbe7af", "value": "bot.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b0b082-e1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766706930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706930, "uuid": "84eb6fbc-a234-4ac0-9eac-777d3681a2dc", "comment": "Malware payload (Mirai)", "value": "75dedad5f30cf48540509e00b7d441fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706930, "uuid": "8c37c0f0-c5c2-4359-9547-4278daa6a3d4", "comment": "Malware payload (Mirai)", "value": "f8cfea1b98584fec6b7033dcbb3d56a79c2c1afd832e3817313abdacc0cb7c80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706930, "uuid": "3e19fcac-c92f-48a7-9571-3bf568425472", "comment": "Malware payload (Mirai)", "value": "55c426f4af1cfa8877c62400ac74e614f2ae5222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766706930, "uuid": "c9ff892f-e379-4a08-a69a-62ddf3d8c34a", "comment": "Malware payload (Mirai)", "value": "b94c1afc268c5d89b19633cb16b317c9ea04e1e432efd06b7916dadb8f7bab0a72ecacd13c77d55d63fcfcd83af4d992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706930, "uuid": "fd9ad0b0-a855-4d79-b85b-a11d86ac6e07", "value": "T10CB3D70A7B650EFBD85FCD374AB85B45258D960722E93B3A3974D818F24B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706930, "uuid": "8b8e25bc-c789-4a9e-8613-4b874cc252cd", "value": "1536:xwqw3NpchRKdZ9Nzxzr8n1PpzDDJ0Q4LEaMIIFtl9PRhkUVBFxT2bVR:xi0hkdZB4PZlVDBjT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766706930, "uuid": "0b6f55e0-9d02-4017-825d-7e2ca9a7d147", "value": 109420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766706930, "uuid": "9e98351e-9f3c-4015-bc37-2f56e193a6c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766706930, "uuid": "406b0cdd-293f-4547-b0a8-5c0b8ad3baf3", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b602b420-e133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766627266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627266, "uuid": "bd325bf7-d188-4a08-a758-23769593415c", "comment": "Malware payload (Mirai)", "value": "b134fff982adf0f53f541d27a4432909", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627266, "uuid": "0d3fe405-cbf9-4a61-ba0a-89b5594756e8", "comment": "Malware payload (Mirai)", "value": "f91893c17e82c212b00b99b669bc052edfca640d66e4a5993d9c2b9da87d805d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627266, "uuid": "9b31536c-bf52-4bf1-aca6-02a9d9382b9c", "comment": "Malware payload (Mirai)", "value": "aba996e5c8aa1e1c2ea728737a1fb664777521c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766627266, "uuid": "7fe732a8-1e96-4551-946b-455b2f847b3d", "comment": "Malware payload (Mirai)", "value": "382a349c1999de78a6c1ef74f7f44c1f3650da3283358e07eb39edc0d2618a9099e9d9d4a4897d7650171b09ab5c5e03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627266, "uuid": "951cf514-a44b-4f6f-872e-f6427bced457", "value": "T133331985B8859616C5E4227FFA2F028C372623B8E2EF7217DD126F15778A82F0D37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627266, "uuid": "96d3fed9-9ddd-452d-bb44-a882e0066dc0", "value": "768:1hWNe27yzchRb5WIgWm3xRczyknS+2X7e6+Jc9t3cMX+lNFcP4B4oQTh:6Ne27yw9g93z6rnS+p7q9R+KNjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766627266, "uuid": "3db25aca-4841-42f5-a1f8-390da736ca2b", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766627266, "uuid": "14e4082e-c469-460e-ae00-fdc3abf6c71c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766627266, "uuid": "d92a0369-89c8-4a7d-a7a4-c021db3e50b0", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f75588-e195-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766669200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669200, "uuid": "3030c499-03a9-4fca-a41a-1069026666f5", "comment": "Malware payload (Mirai)", "value": "87af60a6a0685176e1bfbd101fd0190a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669200, "uuid": "76ee5a7e-8c28-4304-a26f-e33c33231055", "comment": "Malware payload (Mirai)", "value": "f970290ff41ba899fedea4999e76461860b7cdab86a1847193302edb0ee691ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669200, "uuid": "1cc2e236-131a-489f-884b-08c1f455f671", "comment": "Malware payload (Mirai)", "value": "a6c125a868616b917c0cbd941d377ff0b7549182", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766669200, "uuid": "c3324648-d00f-4760-8456-0e0a950a8054", "comment": "Malware payload (Mirai)", "value": "1b69f77ac12364f0f6c13d72b3305c071dd41dd2c21faf19878f089576aa9ae9d8d4d3f6758e688936dd72dd676f4209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669200, "uuid": "691679fe-97df-488f-814b-5b016daf0e0e", "value": "T1DD534D21730C0A47D1A76EB03A3F37D1D3FEABD021E4A989290EAA8591B5D3E50C5DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669200, "uuid": "dc6a801e-a29a-43a0-9bc4-dccddf2f131c", "value": "1536:Nd9VxwUWhfkjf1tfrFYggWz1CPHqTmq9JjMUIuTPxkw3W:XpWYrFvsiL4UIYPnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766669200, "uuid": "a9869c56-7926-49f2-a4df-df9f5d1376df", "value": 64456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766669200, "uuid": "609f0244-277c-48cb-ae6f-ed79f6f1ee35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766669200, "uuid": "5f3ce762-cc64-46f8-a580-3b5ee594a253", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6856b178-e17c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766658489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658489, "uuid": "52dba19b-f8b5-4446-989d-8782334a8986", "comment": "Malware payload", "value": "1a529c155fce52a916b33500095113fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658489, "uuid": "7b8f233d-6827-4b67-9bea-1eb9768ab01f", "comment": "Malware payload", "value": "fa388a6cdd28ad5dd83acd674483828251f21cbefaa801e839ba39af24a6ac19", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658489, "uuid": "bbf5cc56-4f3c-4c97-95e1-e0618731b10f", "comment": "Malware payload", "value": "b5f4ddd2b8ed480c7f04c886b796d5e4048a3974", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766658489, "uuid": "9bd54c8b-1891-4b5f-8f9a-62890f2f669b", "comment": "Malware payload", "value": "f1cf52d2928d0035f29c9f7e527982d1382f799d6bb3cdab44b20214d159abdace5d7027d7cd24220581bdef9a61c662", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658489, "uuid": "280ea874-c6b1-4534-95d2-125344beb8a8", "value": "T18BE22AA2B74945F2EA8903B13865BFAB8ABC75700FC445C3E787C71E4CA89D37579182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658489, "uuid": "6a6f9ecd-4273-4750-8f51-7a5c56baa81c", "value": "65d084654e859038e46ca1b895e66b9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658489, "uuid": "f4a8705f-34b9-46c4-8bd6-583cd21e5dda", "value": "768:M4Vk5q5YKIZS6PJEC4anxvblhJG7i1Q/9t6Xjw7ezsin+:xV0aWRJganpb/JCHWsin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766658489, "uuid": "76713e2a-4060-4799-bfe2-c4c3a8ab18d6", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766658489, "uuid": "66c847ba-5466-47cf-a745-f4c9ec2ff8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766658489, "uuid": "209e7799-8e55-4d0b-bb05-1840ef83283f", "value": "fa388a6cdd28ad5dd83acd674483828251f21cbefaa801e839ba39af24a6ac19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee1b9c2-e154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766641534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641534, "uuid": "b8d9db56-3442-4563-9aff-39ac9a345d69", "comment": "Malware payload", "value": "b3b9004a96188093a9722cd05d4d77ec", "object_relation": "md5", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641534, "uuid": "937f61d7-c79b-4a1f-a14d-c18b330b9f49", "comment": "Malware payload", "value": "fa7b00e450aba0f663d3963d1fbead310ee12182ced9f8e6a82c7df884723242", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641534, "uuid": "b8893b86-5933-4549-994f-cf1b1ba4170a", "comment": "Malware payload", "value": "669ce0b83dc13ab609893550de86a9d224ebf54e", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641534, "uuid": "ecc4c364-0db7-4058-a136-861f69f05afa", "comment": "Malware payload", "value": "f784853b40b09cc0673976c84827938b2896c98f13018dc47dbdc145e851117f23f792a7efd411ca6afc78a4175b9c41", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-3", "colour": "#97040A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641534, "uuid": "715a8af5-c8ae-442e-b38b-1bcacd68b9f2", "value": "T1F68733C4E953EC9F4CFAAA260CE54548E5CBD14A9D869C0A723157786FCB3DCF21B842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641534, "uuid": "235f3596-9609-4903-9b25-fba846fb9d50", "value": "786432:DHqeZEyIsXNBe6ycXGJSSuykq/Oh4W3DQnDvGLjs75NcZFGZ3DOBG:ueZbt906yc9ykq2P+DvGLjs75NcZtBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641534, "uuid": "85fbdb3d-2870-48a2-a263-d162746b0688", "value": 39180711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641534, "uuid": "5eb91e27-4682-408f-85b5-7859fe8ed331", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641534, "uuid": "3c83c02e-ab9c-4fc7-a37b-bc37f9243fd7", "value": "fa7b00e450aba0f663d3963d1fbead310ee12182ced9f8e6a82c7df884723242.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010303b0-e133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766626962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626962, "uuid": "43afc092-e51d-464a-a109-6e2598362641", "comment": "Malware payload (Mirai)", "value": "62368bea0742885029d2adbd8ebdd27a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626962, "uuid": "5914abf8-51ab-4bbb-b790-735a2dfd5de2", "comment": "Malware payload (Mirai)", "value": "fb34871f216659fd07819b1827668836f3f28cd5f87d37953b0bfc2b3eeeb101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626962, "uuid": "a818c517-9f8a-4530-b304-63cdcd8dfced", "comment": "Malware payload (Mirai)", "value": "3cfd4b06c5edc6b02d9de2a6287a510d47d0ea78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766626962, "uuid": "f1735337-898f-4e31-a3f3-87e4c520ebf7", "comment": "Malware payload (Mirai)", "value": "a38fd0e692ecba42cd234cbcad140f96beb23a575851897a03e33c7c80d848582cd55d18958fe9c05e4eb3ab8c657af5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626962, "uuid": "b25ecea2-5620-4827-97b8-0f329c91820b", "value": "T10A835C86E400CDBCF90BE67B84570F04B5A477D15F930F2AA6B6FD63AD710984D1AE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626962, "uuid": "0462220d-a620-498f-a85f-0c94690d741f", "value": "1536:2X2yovh36qBMW8/EuFCdho0prOj8Q9OxHdkXxQt1DgzZ5+AyVL:2X2yu6dE7o0palOEXxe1DgzvNSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766626962, "uuid": "773e4675-5e15-4f40-95a8-aed4cd1bc652", "value": 81168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766626962, "uuid": "9aa8c283-2782-459c-9b53-919705d04743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766626962, "uuid": "ce7a2653-2781-44ce-8b4d-b355f5bcb6a9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d4e499-e17e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766659484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659484, "uuid": "40301bce-70bf-4640-b7cb-3d56b6be3bac", "comment": "Malware payload", "value": "c8e1613e5efc38ef7c5779876d0cbb29", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659484, "uuid": "0149c5a4-d4e2-476a-9ab8-9b7dcc30a676", "comment": "Malware payload", "value": "fb71fdc18155fa873c273d93bb16f99c5f39a3ef2576782007c9d74e4875a786", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659484, "uuid": "0fe508d4-c643-4b83-965f-fc33265d98a1", "comment": "Malware payload", "value": "90a3aa119bd23921d54827966970cc9d9fdb5c4b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766659484, "uuid": "017bc9dc-0618-4b87-a44c-0c0a076f2b54", "comment": "Malware payload", "value": "f1fd80e15004a96a872c972f1d1c52366036cd6b1268e7ae5acff88d8f94ffe3d1cfedef47eba92c121c6a91dd21f0a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659484, "uuid": "64fee4de-b650-4d20-bf49-3fd5dab47b88", "value": "T1861156DD3CA87276BA0FF9C8702D910C7A87CEC5F036C710B16044A18985911EF65BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659484, "uuid": "fe8b5210-253d-4524-b929-65e7bc72f773", "value": "24:3J33rqyNNIG0VbKTRjn+FVwNfmV2IneCGWYHA:YyMe1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766659484, "uuid": "885ff1e0-5564-4673-8ef3-06b15e49a345", "value": 1068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766659484, "uuid": "5686f6bd-702d-414d-b50c-f764b2fe5c0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766659484, "uuid": "5d9c1c43-4398-42a8-882f-75f8f5c1cb9b", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af360fd-e19c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766672210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672210, "uuid": "ce5bf6a9-28d9-480b-9b4f-ec04aa312d46", "comment": "Malware payload", "value": "6fe51d6b83cc6233c859c395670ee762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672210, "uuid": "bc076e9d-e3d7-4423-b926-5ac1c0ac0bbd", "comment": "Malware payload", "value": "fc250e902ae8ac6263e41bc9c070edb6a39a70eb9eef90449f21fee105b0ac4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672210, "uuid": "9c218da8-91d0-4bab-8770-45a14af90e76", "comment": "Malware payload", "value": "d8d51bd115e87752b97ee310e4fafefc70d3bada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766672210, "uuid": "3147fbb6-0218-4b5e-96e2-864f569cc542", "comment": "Malware payload", "value": "f95a5463ed8694b1efcd1ae25926ef6f76eff86190c49c16967e6f2b554632f1242232ec9a8d2a193c31d1e1d64807ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672210, "uuid": "69446bca-539e-4f57-880b-86fa1853dd17", "value": "T187131F2439E9103FF5B39EF02FD869E5BC9AF2FE2B1754A6107103C64B41A50DE5263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672210, "uuid": "77381244-c2cf-465e-a2b6-dbd0444d74e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672210, "uuid": "432f9087-e1b8-45a1-b67d-3dbd4dee2387", "value": "768:ruQ6Bkuw8GqSB/apM0+1qqw6kv41tR8DZyfAx5a4M6Sq2wkrIzVzE8jNEUlznkra:NYkuw8Gq0/ap+kqw21t+SAx5aOS7wo67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766672210, "uuid": "84be8af0-f13d-4809-9d83-228e063bf5de", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766672210, "uuid": "2e6dca99-5b16-4358-bf2d-05bcf39d0598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766672210, "uuid": "408fef8d-6a60-4214-a13a-c04145ba3c77", "value": "sys_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2065c8-e18f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766666598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666598, "uuid": "6de0304c-0025-42f9-9ed8-a5865e47c484", "comment": "Malware payload", "value": "38abc9644b7827ed6b115303aa18202a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666598, "uuid": "ea6b3a35-016e-40f4-89a1-40ab4869de9a", "comment": "Malware payload", "value": "fc9b88fb8c1aada640dd575c33e8fc1550538c4a07b055feaeac14694b829221", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666598, "uuid": "9a52ccbe-eef7-46bd-aece-489ce4f0435c", "comment": "Malware payload", "value": "bd77a738870c8ceec6742446596a72e32d3ddb96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766666598, "uuid": "4b1af255-2b79-4185-ad0f-20e1a2d436b3", "comment": "Malware payload", "value": "6a62c129c7a43cca3e5569ad5dde36f291cc91aff629211c173561a9d89ed8caedd99e87bc4be41a1866ce766e1ed363", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666598, "uuid": "aa736263-16c9-4788-8779-f6497c32b2c6", "value": "T1509122242BC22361735BDED7A52B28C1ED3C84573D6B4C8FE208B8543C5D619EAC5675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666598, "uuid": "940c1e3c-4155-412c-a309-30fa57139065", "value": "96:tNFkHEwmgjMISto1yg/NF7QHR0INFzowXh+aAt+PJGSWWpMyWsVo:nFkHEwvjMD61ygFF7QCiFzowXkaAcPJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766666598, "uuid": "c8db36ab-24e5-452e-83c0-6a74164bfd51", "value": 4581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766666598, "uuid": "bcd1716f-4678-4ff0-a4b1-1643f4f60668", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766666598, "uuid": "6d0a27d2-d837-48ea-a1a5-b098c50424f1", "value": "callback-fetch.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff00b87b-e1c3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766689236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689236, "uuid": "d4295fab-2252-46cc-817b-4a5276676098", "comment": "Malware payload (Mirai)", "value": "a7c5256c95c4d02d2487f14f42b8d207", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689236, "uuid": "f382f161-93fb-41ea-8cf2-bbde7b228733", "comment": "Malware payload (Mirai)", "value": "fceaf47b27863da12673644667f26495ca01ec4de74ea752e84ccb41d5a5ad26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689236, "uuid": "364e6416-053a-409b-a639-45c0b1416254", "comment": "Malware payload (Mirai)", "value": "65c696c6bd4305450149ec80919a7764a593a858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766689236, "uuid": "b0075b18-e77c-404a-ad68-7c16c0b0a387", "comment": "Malware payload (Mirai)", "value": "b1a2f8b36085ada35d489da1d9fc86f825827b1b366b33efde7f143a982dad4ce29ae3feb8ad75cd9812fa4563372d52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689236, "uuid": "a1fd2ca6-7491-4e97-8732-851e108dc2f9", "value": "T1D3932A81BC819513CAD423BBFA6E418E331663A8D2EF3217CD256F11378A96F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689236, "uuid": "108bd20e-276a-4307-b8bb-8ce8bc2aba86", "value": "1536:/jaNQrP1aNSjrTDwO4hcW/X9+GecD/VDd3TTK/77rrf9SOvA:/j9rP1aNSfwO6zl9BK/rrlpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766689236, "uuid": "ca749c93-6c0b-4076-8e92-4ff4b079b082", "value": 88956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766689236, "uuid": "92b4500e-bfca-43ba-a0fc-b728d8ebef98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766689236, "uuid": "2a276b7c-7fbe-459f-a804-fe17bf55cde9", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c31bf1d-e1c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766690332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690332, "uuid": "fea50963-2ef1-4889-b4d0-ac74d44b5686", "comment": "Malware payload", "value": "7a3bc22470e50d7f37acc43d4d19ffe5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690332, "uuid": "5814baa3-0d44-46c0-9708-4951039fdff7", "comment": "Malware payload", "value": "fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690332, "uuid": "dcf92d8b-b047-4f46-8029-1ddc79f999a5", "comment": "Malware payload", "value": "073b24d629d052f4ea0119c2b92d0de75283e76a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766690332, "uuid": "bcc0a84b-9fd5-4e1c-82d8-2d320c2757fa", "comment": "Malware payload", "value": "97030ec8ac0074c9d71b228fb63bf4037ccbf124e618132000c985ba5d4821375e98c30413af273fa99c6fc4e6ab400b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690332, "uuid": "923d2b22-1e53-4b58-af59-d03430863307", "value": "T1BB1149CF159152714808DEACA97B441C959AB5C1AEB0EF3D9CC45E3FCCDA62D3038E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690332, "uuid": "bb3bfd1a-5934-4a4f-a16d-99b26686339e", "value": "12:oMyxEhbVsljf9NIl5tnCa0LK+WNgO1OJiccO7ChSvVANtjKVrf2G9Pc0ftdv:t4lRNI7IKG1ieUA2NtmdO0Plf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766690332, "uuid": "8866b376-0b30-473b-939b-4dd73406aea7", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766690332, "uuid": "2b3737a5-5038-4cf7-8e2a-05722b35d5d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766690332, "uuid": "87d41390-5b61-47dc-b69c-95b5f6b3afa8", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a573905e-e1e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766704977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704977, "uuid": "c73a7b59-4826-4c22-913f-b11b02e0e9b9", "comment": "Malware payload", "value": "6268f214673ade731fd4f0c063a90f0d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704977, "uuid": "426f0765-11ba-436d-ab58-7015b14c8ec4", "comment": "Malware payload", "value": "fe0201cbdebd8b9ca73543db69d72817b96250e8dbed9175ed09cae29759438a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704977, "uuid": "0803c7f3-934a-43e1-97ff-6252a35e575e", "comment": "Malware payload", "value": "7a1c97e8f24f8642d60a680fef7a7cc51260ac66", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766704977, "uuid": "936dd316-30dd-4604-81dd-61ed52b9c2aa", "comment": "Malware payload", "value": "d365ad55a63ef2359ced1854ba43f00ac66a3c2054bf14eecdb4cbc60cb2a6d2fd78cb5c944551e43ba8ba41658e9ce4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704977, "uuid": "b87889d6-f00f-4c32-ae4e-520ce9980b58", "value": "T1DB764AD2FE401315C69BE336E4B52285A330B449137526D7BFA50AB95C1BEC41B3FB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704977, "uuid": "d0be1d47-75c0-4d84-a342-cebf52b004f4", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704977, "uuid": "b16e70e8-3db6-4173-8292-67f0e7104377", "value": "49152:k2kS6Urb/TgvO90dL3BmAFd4A64nsfJdDy2ZJGZCE3Ja333fCzNTQAPNZvob7G41:k2zGkiKQRU8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766704977, "uuid": "46d72608-0320-4eeb-8aa2-cc5ce7ff0b95", "value": 7757952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766704977, "uuid": "1c9cdc45-3ac9-4c8d-b9cf-00a396ca0dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766704977, "uuid": "1248b1d6-d52c-43d7-b580-336b37be06be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16c914d-e12f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766625513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625513, "uuid": "264039a5-df1a-404c-b8b0-603f1fbc97bb", "comment": "Malware payload (Mirai)", "value": "04ee2ff6ea63ac4f86db8a77ba20fb00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625513, "uuid": "0c8202b9-8cfc-41a9-af42-7739f153e91b", "comment": "Malware payload (Mirai)", "value": "fe43660a35c455186b7b88c170f4532f1a4ed2e4e97e4d5df1e1ebd139a8c33d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625513, "uuid": "250014c9-9a15-4811-925a-24c44053752f", "comment": "Malware payload (Mirai)", "value": "37b92557bc42451050838f8803b6e837d7e60cef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766625513, "uuid": "7aecde1e-8fe0-4dbf-aeb5-cc30746c01fe", "comment": "Malware payload (Mirai)", "value": "63f1406279249e064a2ee8b3607d571b75ec5f9ebee4f6913273df12cf1b0235ff9c3e2a53af8373efd47a0d7e5c950d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625513, "uuid": "0336b258-65e5-4acb-8acd-34d46be3b4d8", "value": "T11B733B86B401DDBCFC4AD77B846B0F00FAA477515E520F26B65BFDA3A9312944C16EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625513, "uuid": "b7c69c29-e164-45d2-b49a-7d426bb76a6e", "value": "1536:72M8ct41Jm2xE6c4nC2PsV88QcZObTn9iwOr5fumCIldoK:6M8AWEOnCAkVM3QwG5fumpldb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766625513, "uuid": "525ea30e-3193-42ff-9f3c-0ea5b30a9618", "value": 75208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766625513, "uuid": "cabf47e7-70c7-4469-8851-c64ea0764ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766625513, "uuid": "cbed591f-963e-4719-8064-84dc6fd01310", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d37b74-e1de-11f0-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1766700490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700490, "uuid": "e168f0d6-e814-4d8b-921d-a228eced50fc", "comment": "Malware payload (AmosStealer)", "value": "6ef01beda5bf9bc38b921c870145f610", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700490, "uuid": "0c5d277c-adcb-4c65-a55b-e7e9a217667c", "comment": "Malware payload (AmosStealer)", "value": "fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700490, "uuid": "93975ca0-75d7-489e-a822-6ecdf395b8c5", "comment": "Malware payload (AmosStealer)", "value": "0fb6567c83e7d285e6d82e87132a2b81a29f67c4", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700490, "uuid": "5a9c4a1c-6661-404b-9d98-397e89e0bb3b", "comment": "Malware payload (AmosStealer)", "value": "090895c71e5fdf8727e790231edf80ed5c52d9cf51781357ccdcf7a8a70de1dc9536095ce2d5b5eee2763a207b99d0fb", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700490, "uuid": "dfc92857-7d4e-4830-b132-252cae89e779", "value": "T1F9849E0B9F2D9D1AD0C0D07C978E9A63D222F1781722632F3F51469DBE58AE43A1DB17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700490, "uuid": "c7b758b9-83ad-4eb7-8ba1-ea08cc5d7dd5", "value": "6144:+p1D11lFz1f59Ig8UQTovai9xW692E6OPhcJ8+I3OP1D5Ym:+j5brf59Ig8UQ8txW64EPSQk1D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700490, "uuid": "ccf2d629-e861-4fea-9fbe-ed2021d6acb4", "value": 370944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700490, "uuid": "39ef8bed-0dad-48c5-a991-317a21cb754e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700490, "uuid": "b9240b18-0526-43dc-97be-4e2aba7a5e0a", "value": "updater", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22944886-e1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766700892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700892, "uuid": "9abda6ae-83fc-4203-b06d-2b2f01eaf41f", "comment": "Malware payload (Mirai)", "value": "67b477e44254c9e91d5705a413e513b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700892, "uuid": "70052c6d-5341-4b6a-8f75-e679dd0800f9", "comment": "Malware payload (Mirai)", "value": "fe84869fb1b15a2fd7a4e020901e70255391a39c0e56e30699bdeff5cf20b230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700892, "uuid": "5cf61d03-3e2d-4f8b-b1a3-67210de2f9eb", "comment": "Malware payload (Mirai)", "value": "1cac8125df178fe2b8779c4f4ef7b35237516483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766700892, "uuid": "763c1724-4bc4-40b9-ab87-e5d4644ae2cb", "comment": "Malware payload (Mirai)", "value": "f79e7c0893f0e9db5110bf2c1f90568b5f439a7b713c526e419317bb6376215b61e6c07e8e8f70badd300f8ed13c02aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700892, "uuid": "ed832a4a-df9d-4f55-87b5-f697f0a0efb3", "value": "T1AEF3C40E6E25CF7CF79A833447B79E21A659378326E1C547E16CE3115E6028E640FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700892, "uuid": "022de80e-04e9-4e26-8052-1e09da028416", "value": "3072:wu4zj7WKM+ftXnmF5tCL3fJosHs6QJFZY/nTIl87Qo1h2PjJxDshC2JabWubbzYD:wu4zj7WKM+ftXnmF5tCL3fJosHs6QJFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766700892, "uuid": "2d3a5335-4169-4e35-8cec-f5babc408b6e", "value": 164140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766700892, "uuid": "d8aa5281-61e4-4dc1-845a-8bc4b432809d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766700892, "uuid": "53bbff1f-bac6-4348-b727-9d31f4a26ad0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57d595c-e154-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766641492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641492, "uuid": "f4705b31-f693-476f-96e7-e24c30087f33", "comment": "Malware payload (Mirai)", "value": "cfd335242a67421ebe0dbc018e623751", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641492, "uuid": "255bbfdd-235c-42a8-8cb6-71824d8238b6", "comment": "Malware payload (Mirai)", "value": "fee8fd074562f877a74d2eeb1de600d9f9eb13ee4581148e7b894b599dc74bec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641492, "uuid": "86a4312d-00fc-400a-b339-0f879cada637", "comment": "Malware payload (Mirai)", "value": "bf7bbd6c25e0eb88ade4969e5103c274e1683951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766641492, "uuid": "6654b557-225b-4fb9-b86c-09e9a47cdd49", "comment": "Malware payload (Mirai)", "value": "dae6930fea52bf83ea5b8534150cbcc56dd926a51e3281589be7ee6533afb28e4e0951f71f64f3c689dd70b0a7ecda99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641492, "uuid": "c95e9156-13f5-4988-a55e-16afc7da2a35", "value": "T179735C42B3180A43E5634DB0293F27E193FEA9A020F4B789655FAB8A4675E331447FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641492, "uuid": "f65aa6fc-fcd8-4560-9887-38b3bcdb8512", "value": "1536:Ry6PrqnJPNBIII8qee4VWW9dGda4P7CpfTwt:P6vXqeew941PMTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766641492, "uuid": "424f51c3-54fa-4457-92b0-d6c3091a0e7e", "value": 79140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766641492, "uuid": "0d58a1ac-2b3a-420d-9615-0f82a81e6fc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766641492, "uuid": "0fec6d85-4a96-4130-a12c-774baa657bf2", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }