{ "Event": { "published": true, "date": "2025-11-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-30", "timestamp": 1764547382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8b12f4e9-844f-4654-bc33-2fad40c42e07", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30fffc0-cde4-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764504366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504366, "uuid": "e31bebec-af6a-4056-99a9-3aa90d68299c", "comment": "Malware payload (MaskGramStealer)", "value": "51343636be68bae2131e70c37ee6ea6f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504366, "uuid": "1ee1a78f-9128-4d55-af23-d1438c1f0deb", "comment": "Malware payload (MaskGramStealer)", "value": "0062aa0a736250da83b32b000d1dfe04c89615dc8971a2e29124517b4660e33a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504366, "uuid": "a5e3a0a6-b441-41df-96e7-2a97fa82d11b", "comment": "Malware payload (MaskGramStealer)", "value": "32b5c8eb1ef1dcf6d0d9ea0a2df03285b77f316e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504366, "uuid": "4ef77bb5-a277-45f8-a84c-ef75bfc34891", "comment": "Malware payload (MaskGramStealer)", "value": "7ff484f087838fa862b23a130e2092cc8baa264573b5e0e865765df34f4bf0281bdba4b56d99406411ae7c1623256641", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504366, "uuid": "f5e46e4b-0f92-4650-acad-726c69ab8901", "value": "T1A9D51284782F14C4DC0DBB71AA9A9A7A07592F14D9F7646CC5447E323A7263E7E0C0EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504366, "uuid": "7f5c4830-3621-4ef7-8b1e-b87739f5a265", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504366, "uuid": "ff7eacd5-15e4-48c1-b156-ccc47b448f8f", "value": "49152:MfRmnrtbXYTlIRJvm0zk93C733JdCZx00Mdf8TBaGjycq9X:MfRIJbXYTlI7ukz3Jdqs9IO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764504366, "uuid": "e91bfd1b-56c3-4046-888e-b4831b05bae7", "value": 2817024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764504366, "uuid": "668a4516-e8de-40b2-9b4e-55824d2402f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504366, "uuid": "38fa8ef9-9b7f-43db-8129-d2eee10f6997", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624ed233-cdf5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764511424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511424, "uuid": "fe56f12b-dc27-4086-9f73-bfe3fdabb568", "comment": "Malware payload", "value": "6d4015c5abfd5d586ebae9c68727e62b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511424, "uuid": "5aea5200-80fa-49b7-9dc5-ec023bec913e", "comment": "Malware payload", "value": "02034fd1cad43208ee78850e53085b59d61dbff31be13ceaf74ca00ffed5559c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511424, "uuid": "46b90b49-d4c6-4829-8642-0cbc9a877a5c", "comment": "Malware payload", "value": "2330a2b439444c7d4f986e75585e085fea3938aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511424, "uuid": "d5a5017e-60b6-495a-9a22-6e3d678179b0", "comment": "Malware payload", "value": "32ec491c8a951b9949689cfe516c120220df130925bbfdb83c850940ddfe7bb78749bd2940ddece25bce910357075347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511424, "uuid": "bb96f9b9-8719-40b9-b8e5-f86755664e37", "value": "T157257CD68AACD1ACC9E5E0F4D39F813A907B30CC9E01AD5700D9196135A62FE3D6927F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511424, "uuid": "31fdb319-0654-45ef-bc5f-8a34d441e14d", "value": "48743f95839b0c0d27c1a9ab7a9db67d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511424, "uuid": "54994e41-a986-427a-a0b0-0521900affe9", "value": "24576:yb9o5HiJQIOsvWdB8CXNkw3Csxy/TNh8cp592o:cqCJ1Osv4B8CXZry7v8cp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764511424, "uuid": "74183d5f-2e1c-4d34-8468-99b412404483", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764511424, "uuid": "d207105f-9369-47b2-9ded-eb167eaafe94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511424, "uuid": "a1440fe3-44e0-4d44-badb-f9cc21cf436a", "value": "Simplenote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b674da-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540148, "uuid": "ac3e0afa-965c-40a2-a61d-242ed68ae784", "comment": "Malware payload (Mirai)", "value": "9b762e01a21f6d522bca42ee2bb41f2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540148, "uuid": "14928072-474d-4859-9c8e-370ceeccbf0e", "comment": "Malware payload (Mirai)", "value": "020a32dd5a82f8641117ed2f22d5162d3c2fb26167e9c0660d3b108887c7ca98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540148, "uuid": "2d67423b-28f0-4f08-b15c-ee5b69a33bfa", "comment": "Malware payload (Mirai)", "value": "f41f486c5554914ece151a25c11c3571eb84a497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540148, "uuid": "2f727195-3d68-4b01-afa7-6ab8eb8dde3d", "comment": "Malware payload (Mirai)", "value": "8dba3a2e734e2e8464ba12dabf339c3f245476762d0fe0b14971afa0249e27648633fbdf852da69588b0c3eb04bcd807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540148, "uuid": "3c88d8f4-3cce-4817-ac71-f4a82a25a5ed", "value": "T1AE63951E7E259FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540148, "uuid": "074190f6-044c-416a-baa7-9d46d72c5200", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAQ:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzrL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540148, "uuid": "0a4bc2dd-f91d-4f8d-aa89-3f7fd452ad41", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540148, "uuid": "da92c8fb-78c7-4a2c-af3c-26160a74c3cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540148, "uuid": "36003c50-0263-4a75-9393-e92da14f0712", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac07ae3a-cdf8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764512837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512837, "uuid": "0264e5f8-9add-4343-9df1-001651274836", "comment": "Malware payload", "value": "f5984a3078aba401f07d174e28c2ec4c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false }, { "name": "VBS:Bicololo", "colour": "#5B9C9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512837, "uuid": "66d844c2-a45a-4424-8bd2-894ba65fcb67", "comment": "Malware payload", "value": "026d24cf3a2794ceb49a0b1f7e276b8755409e75a599dffe179ff73b97d039b6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false }, { "name": "VBS:Bicololo", "colour": "#5B9C9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512837, "uuid": "009a8744-b645-4e3f-9399-c8a5aa6b7d60", "comment": "Malware payload", "value": "ea89500103c864b89d822dadc3492f76099a8084", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false }, { "name": "VBS:Bicololo", "colour": "#5B9C9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512837, "uuid": "97d81d7d-6594-41ba-8eed-79af1c05ea37", "comment": "Malware payload", "value": "33235e69d191d499e935e9c05ae1111e7ffb8831d4ca5d8b9ce4672157d935acee6fb956986a1e13bedafdd141be89b2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false }, { "name": "VBS:Bicololo", "colour": "#5B9C9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512837, "uuid": "55e7a588-3efd-4362-a605-2e7d11a9ec77", "value": "T13AB48C177D80943ADABA0E36893A97719F3CBD240B31855B6384751DDEF40C06BB6BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512837, "uuid": "f486db68-43b3-48c4-a4a6-4b4f15d74f54", "value": "6144:y/mZE1jOZy2KL4GBiwQtEa4L2s41xRe0VkahMVDuSPiR5p2rrYu:y+8jOZy2KsGU6a4Ks41x5Vk2+rig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764512837, "uuid": "85cd58de-f076-4c0b-bfd3-eaf56bab959e", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764512837, "uuid": "69673ca8-7c48-4efc-9cb0-9f17435bf897", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512837, "uuid": "49c98804-a2cb-41d8-808b-963a6292d85f", "value": "1213d4e7c6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60a39ff-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490600, "uuid": "dbe68810-7f1a-4f33-a402-2c4f8748d557", "comment": "Malware payload", "value": "bcbbe129e6032fdbee6e2df28fef55e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490600, "uuid": "502f580f-3876-46e0-ac9d-b750e710a7de", "comment": "Malware payload", "value": "03231f35406136a3aa0c41b2e89375451177fe8cb025ed1341443b4bd4c21c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490600, "uuid": "36cd08ce-0396-423d-b195-1de1de0f804f", "comment": "Malware payload", "value": "fb9e26f45ee4cbe3c80895cc43f20575dfbcc5a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490600, "uuid": "2fb9732a-b8c0-41c3-9b22-8a9a47d623a2", "comment": "Malware payload", "value": "ce65a2f42250369a66082b06a0820b713c865113dc117991ae66e051dba8cea325b8631a2a90a8ebeb3da3d95aa33c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490600, "uuid": "a8c6bc22-49ed-4c45-90de-ef08d271f028", "value": "T1E926E0097F80AC25D869F330A17556618A25EF23C66188873B6CBF399B341F37D3961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490600, "uuid": "39e946e9-705a-4d9a-9038-7195a5a8448f", "value": "243791299897c13fe7d50dafd2aeea9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490600, "uuid": "4b3535d7-9521-4a09-86d1-1f057d8cd5db", "value": "98304:bLnsPAtMWV7PwyLSSJQvWUCLtb8LpyIK/tJY4SKLfBzo:bjsYjN9UCxqk17Y4SK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490600, "uuid": "639a39f2-c04b-4d09-8281-12cfb79f0fd0", "value": 4712960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490600, "uuid": "199d2708-a236-49b6-a720-130e6d065993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490600, "uuid": "0c6d1435-1d73-4eae-8ef3-2254aa7c35ee", "value": "JiYuTrainer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c69cb2-cdb3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764483214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483214, "uuid": "068ae0df-57c9-4b25-afd7-726a16cb657a", "comment": "Malware payload", "value": "853a480c59a44076dd553bf1388a3443", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483214, "uuid": "2aa7b8b4-7f1d-403e-9c39-28dc7d0f2293", "comment": "Malware payload", "value": "05167a0b2c9f8ff23fc5aa0c9a9a71a6a81c89fa8fb23e8b98627380d43beaac", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483214, "uuid": "255029c0-601a-4802-98b3-2b61751ee740", "comment": "Malware payload", "value": "ec15487e660d693a2959f9df3361677d6525da22", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483214, "uuid": "e36f5e8f-70b8-48cb-9c2b-e4e547dfcda8", "comment": "Malware payload", "value": "17caf92cfb91342ea377543ba45c804330dc34d9c73e6dbc8194ea5fd3da03e11753b08a78593b98e8f2ff1ccf12fc4d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483214, "uuid": "53a38528-4097-4cd5-8f70-25fb731e4472", "value": "T18F36E007E2A320ECC56BC174475BA772B931B8590134BE7FA594CB312F12E906B6EF25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483214, "uuid": "79e57ad2-2b1b-4e8b-8cde-21733797bffd", "value": "4001d25cc44a5146e1045bfe56dee420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483214, "uuid": "ca56dad2-f950-4b65-aff6-8447d2f0f49e", "value": "98304:lb6AEyzgphbYee+W2/6UQ8mLYW9PY1gEDpYiKr8VEH:pli40iY1bVSrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764483214, "uuid": "7fb8d71d-6527-4c24-b40a-fb43fbe957a4", "value": 5050880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764483214, "uuid": "a33a6e04-1b64-4bc4-a201-a7cceead337a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483214, "uuid": "38e1d710-8751-43d8-ae5f-7bfb4ad2aa3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1387189-ce44-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764545460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545460, "uuid": "2932ccce-343b-4987-ad90-0f6bf69c46cd", "comment": "Malware payload", "value": "607d8b2bda083ed7bdb64e495ee05547", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545460, "uuid": "71de550d-2abe-4b29-a317-cfe0d609541c", "comment": "Malware payload", "value": "05b7bb7d262d79fc64bc86db61ef17144331bfb5a6ee1a9f750933c8fbcfec5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545460, "uuid": "efa95eaa-6775-4388-a4db-d1f2f946c58a", "comment": "Malware payload", "value": "87d88c7c6897f2855513bc356bb1aac65a630270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545460, "uuid": "8b573336-e451-4cfc-b1b7-2df263cd45e9", "comment": "Malware payload", "value": "02a47cdcb5e3f08db227a5ee428cdf881481f6c99909beb135a9456c37338114ac21847de85ffd0f488586fa537d8740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545460, "uuid": "5d80a8a0-40ba-4f75-8b37-94e483ddeb29", "value": "T1296302BB861D4EF4EAAD013BC150AF495EF6A24A35463C4059B07C06271DE0CDA2B7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545460, "uuid": "016764e5-54ab-4a41-a78c-bab808ecf706", "value": "1536:taftR4ylSgQAwg0VK5zCuH9/6eMl1K8iuh9/w9bNZgHhPAA384Njwpq:E1WaOAw7Vyth6nybNEIY8WUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764545460, "uuid": "552f8672-c7dd-4221-8eb9-397da57574fa", "value": 67920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764545460, "uuid": "4f8ab2be-7756-40ff-b2d8-3a71267f138b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545460, "uuid": "e6c77a69-1dfb-47ca-8b56-2aa5ed2835fe", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457c4632-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764530703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530703, "uuid": "45704195-8e5d-4656-bb5f-e7ad20ef3117", "comment": "Malware payload (AsyncRAT)", "value": "28963018c4addb12d84d7fdfa95f8143", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530703, "uuid": "cdaabce7-9a1b-41eb-b77c-f9f2eb075a96", "comment": "Malware payload (AsyncRAT)", "value": "05ce9e030ca6e12da3c8dbe80b6b65131448b694980223b548cba07f0bba4292", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530703, "uuid": "9d3fecba-399c-488c-801d-317a7d932e61", "comment": "Malware payload (AsyncRAT)", "value": "4ba9bb58dbecf5f2afd0dc70d6eaa55bd0ac1ae2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530703, "uuid": "f6e8a6ba-7629-4050-a6d7-b9d41f472d65", "comment": "Malware payload (AsyncRAT)", "value": "b0c2be3d8674ee2c2f5ae797dad00766231f9d19dc53e18ac7c3b6ac2a1edbd9aab572c21436bf018e4ac4fae2b163cd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530703, "uuid": "4b7653aa-999d-4fd9-b6bb-f5c272c5dffe", "value": "T15B215912ABF60204F7B3BE54BE795431093B7E65EE3ADA4E40444D0E1871A18D9B0F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530703, "uuid": "146a786b-f9ab-4e2b-bc76-4f8b96bdbc75", "value": "24:Q2+O9OD6A/VYFp4/WT/DXT/VYAAZTQRtBZTUphfz9ZTnUMkWTX:qO9ODrVYFi/CrrVYAn9UptfnHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530703, "uuid": "5d869e59-51ba-4276-9c82-67ed36a25642", "value": 1240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530703, "uuid": "ff5d1621-eb31-42c2-b436-864c315728bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530703, "uuid": "cfe4e874-7a3e-4879-9ec8-0d7597a607c7", "value": "vvv.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3773cd16-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540129, "uuid": "07ae0d0f-46df-4488-9f64-97786f98dddb", "comment": "Malware payload (Mirai)", "value": "da9298e5a1938b2b8c3fe4d0223e5e8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540129, "uuid": "adb03d66-30df-4a2b-b300-c080519f84c5", "comment": "Malware payload (Mirai)", "value": "060ea79571612c18c8cb5dd595749562f04a1871b59a79721151fd4c25ba70ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540129, "uuid": "5fe027ed-fa92-423e-bea5-110d1ce18952", "comment": "Malware payload (Mirai)", "value": "b9c19dc0da5fa859fe274af13b30961a70811528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540129, "uuid": "7e090bf1-93ef-44bc-87a7-9a1059079a0a", "comment": "Malware payload (Mirai)", "value": "1ccca0b5ab60f68444b1ac8c5ce79137708962889fdc337e6e10f081e596cfd52aa9614d9d67fdf55e52bc6eb9c142ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540129, "uuid": "7a9c7631-5b51-4ac6-87e8-8846bb695aec", "value": "T1E8533917B54281FDC49AC1B40B2BBA3AAD3371FD0228B2B677D0FB262CD6D611E19D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540129, "uuid": "e2ce6290-5507-422b-b857-fd92cb283a9b", "value": "1536:QzxuhwCnsGYiSKdmbJzx/x+TiMl6YZcMzKSFERM/Xc/Mg:Jh9nsGYin4bJV/x+TiMJZcMzKSaRUXcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540129, "uuid": "19be9143-5a94-49ee-91c5-8ff6a5fae486", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540129, "uuid": "dc81c19a-066c-4e91-a993-fef1511291aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540129, "uuid": "be448368-96cf-4f09-9576-96330b62ef1e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d62527b-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538797, "uuid": "9d9e75ad-802f-47eb-a7bf-b9bb571f092b", "comment": "Malware payload (Mirai)", "value": "66cb9bc598af07dbe297f6ca1d6c569d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538797, "uuid": "36215b4a-381b-4a45-a856-abd749863329", "comment": "Malware payload (Mirai)", "value": "061e1627b97b9a217f848ceb74116ff8e847b8e7aed04032c6b67bac6f349ced", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538797, "uuid": "deebcac5-2ee9-4807-8754-24d96f1d9a12", "comment": "Malware payload (Mirai)", "value": "9563cf7cbf00f27fc948ac07f3e5085ffe4bc870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538797, "uuid": "dfe604ff-c970-4c3c-8c3e-0835319d7708", "comment": "Malware payload (Mirai)", "value": "764fc8db26d55a29fd96d2e6da99918d761676483db5da364bf9819565d4c8f6396cc2db847a6c0244287c057ef25148", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538797, "uuid": "cbf60e36-9647-4589-a089-7277c90f0744", "value": "T1EC040905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538797, "uuid": "1470dfeb-eb96-4b3f-aa84-7b648d7b719e", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woAKfLYV0fCtZ1SD39rsJzjM9fx49SY2W:t3nEr5dfHPq7UTo7fsvR9X0l6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538797, "uuid": "df6ed932-2cab-40d3-95bd-304d16c3fbf6", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538797, "uuid": "8e7d2934-95aa-4eee-a817-2b5356ca1a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538797, "uuid": "df6014c5-21b8-42d0-9ddd-e9724afbfaff", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032986f9-cdc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490649, "uuid": "94b3c033-5f5e-4bec-826f-bb057ebfcee9", "comment": "Malware payload", "value": "3f47374e3cdd69b277a074c7d1183bd0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490649, "uuid": "4f4f539b-cd0f-474e-bfe4-3773f2717bff", "comment": "Malware payload", "value": "068bea5a2be6788ea22c94a28398e0b3bb2bd89afb4f361e611faf6ff1cee0da", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490649, "uuid": "64238377-24cd-4a14-bdc0-4486d19410dc", "comment": "Malware payload", "value": "8678e1a9a10f4ca67de761a837b4ce7a7cd7bfd4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490649, "uuid": "c8195ec9-552e-4c8f-828b-69df5591d26f", "comment": "Malware payload", "value": "3f8f9ef03c304e7e5d4ad36b2a4086d94fe4a58a011fca72e9146698a36be3cda6a281967df6b7e22e5aae9ac10a8cb8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490649, "uuid": "c9d38e45-9ed9-476b-aee9-5d005734d46b", "value": "T1DDA733F47051C7DAACE4CA7DB34FC615FA994022A744897E18122192D6CFBCA9F23E35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490649, "uuid": "878981db-1858-4a33-ab7f-a78dee685d8a", "value": "786432:DaPsqPnJcMuV0l5saZr6FpEmTz1wiaqlJBbAoTPLpJzN8ZBt4QU:DaPsq2MFZrYTz1wG9DPzN8ZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490649, "uuid": "f5a3536d-2ded-47d1-8863-9885476caf63", "value": 47299503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490649, "uuid": "f7336526-4262-4243-9a2e-5ce10a997d15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490649, "uuid": "fb617292-8113-4668-86e8-e88240dde213", "value": "y-cruncher v0.8.7.9547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e52a34-cd88-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764464476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464476, "uuid": "ce4eaf66-5bd6-423b-b96e-7cf6b3530f10", "comment": "Malware payload (Stealc)", "value": "3a84f892d57cb3ccbc05ad0866b5ab58", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464476, "uuid": "8ba2cfe0-9e79-4dd3-b085-f088d784eb9f", "comment": "Malware payload (Stealc)", "value": "06e8e96fb9154f8ab7fd22e90d712fe77f18be79545997a2a6fe25b464533d2b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464476, "uuid": "3af77fcc-81a6-48eb-9d64-f1b62d07bcc1", "comment": "Malware payload (Stealc)", "value": "2d0aba15c7db7f25df0b6dc71aae2a02ee63eaa6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464476, "uuid": "c2b2f79b-4315-4ca3-950e-365760dd22f4", "comment": "Malware payload (Stealc)", "value": "4b41a572fd324c796e2742704837f25d33521ca847b94398ed3d8aa099f89509edef5817b02c7666b6081fbf231ec87a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464476, "uuid": "e519fc02-9a0d-4e75-97e7-40569c3a251d", "value": "T14495230717F818A7D4BA977DCAF11503967478B7373489EF22D860AA4E228C5BB79703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464476, "uuid": "321c9126-0107-4da6-9ad4-c59c89257746", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464476, "uuid": "d7693c36-231b-435b-95f0-3c076079879a", "value": "49152:O0T59mkqUa1cipkqS4PiD5BwKAX+h5czqxJo6Ip:Oa95qbeipkpwidvWzqx+bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764464476, "uuid": "edad7c80-8334-48be-8ebb-6b78458f0e9a", "value": 2005432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764464476, "uuid": "3757f297-82ba-46d0-81d1-e3caeae95531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464476, "uuid": "813670bf-dac0-4c2c-843a-46f3de36a41f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0c6f17-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468194, "uuid": "dc66bbc1-cdb8-439d-822b-18d5b58117f7", "comment": "Malware payload (Mirai)", "value": "624879c93026e7d05c29df2d3469c856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468194, "uuid": "20e47693-3818-4273-b685-ca1fa5c11b9a", "comment": "Malware payload (Mirai)", "value": "0768380847fec204052caea7d521b23d739ee8fedbc23831bf2549bae3fb03de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468194, "uuid": "a1f98b3b-f3a4-46de-a949-656a2d1d36f2", "comment": "Malware payload (Mirai)", "value": "91f3f1b34c7d160c7b0db3a4427ffb06fc00d606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468194, "uuid": "6c594a34-47f9-466a-b89e-f173f5baa8a7", "comment": "Malware payload (Mirai)", "value": "7cb7aeeb5cc0469a3a2718efbf07c7971724860972c596792daeb30c70d244535bf0e5f74553ec13da015070fdc21f2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468194, "uuid": "e70fff66-ce87-4ad5-80c2-7ebc9686907f", "value": "T136C31A45F8504B23C6D252BBFB5E42CD3B2A17E8D3EE720399216F21378695B0D37A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468194, "uuid": "f7afbcd2-8212-498e-b493-61db4aaff9d0", "value": "1536:oKTFPaOqB4Unn1TtcbC8b0AOP6T4VwThy7ZceQRYdVFP/o64ljMwywcRZi8nKfvo:oKTS1TmG8b0By4Sg6eQR+XPwct6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468194, "uuid": "a3ccbc67-f60c-446f-8eb2-f3e78f08055b", "value": 129568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468194, "uuid": "555452c4-6193-494e-ab16-b460b15c017d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468194, "uuid": "d63e0877-e46d-4f43-b9e1-f84634a022d3", "value": "odin.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1f58e6-ce2f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764536248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764536248, "uuid": "b584bd6c-42bb-416b-80a8-d423bbe5ae33", "comment": "Malware payload", "value": "6d235613925b199f41433b3106f09387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764536248, "uuid": "bdb4d18d-5b29-401f-a7a0-689b4b7675e3", "comment": "Malware payload", "value": "0842aed4dcf5136de6b4305e8f0828c585338ff0826753cf891b8ef664d8d8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764536248, "uuid": "218b8c34-8e23-42f1-a4eb-e1f673fafd05", "comment": "Malware payload", "value": "ad23c37a70c27e9dc2ca585fda759cafca486b91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764536248, "uuid": "7d22da69-8acf-4547-bb77-e92a6854003a", "comment": "Malware payload", "value": "ce39eb6db3c8ec61f3489bd44d6fdc780154b0b64fb566994b6c149e83c9109b7202819b7e63e8ae977bc64eae9a2465", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764536248, "uuid": "5225bd55-7460-47fd-84e3-f02b29fb56fe", "value": "T153432941BC929A26C6D4127BFA6E418D332623F8E1EF7217DD112F157B8A82F0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764536248, "uuid": "b4416695-c188-47ef-8fd1-43935a7fba09", "value": "768:usJO7t+1/XNVNP2UrGBkzhTMOBMDvPKEM+IJ32Mwf4me0o1NtSj0b9gENJq8Ttu:PO7c18Bk1MM2vPKH+IQ4UQSMhCGtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764536248, "uuid": "2daa80bc-c624-4406-8081-d2ab8609442d", "value": 58236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764536248, "uuid": "d4f54974-6ef4-4a7d-9bea-dfeac0e39482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764536248, "uuid": "fb7e2452-a158-49dd-be08-46416443d52b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455304d4-cd80-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764461125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461125, "uuid": "c8a6769e-6e2e-4ab0-9746-0f2757db1110", "comment": "Malware payload (Mirai)", "value": "4bd0e12e5700a74f8ebd0c16a756b634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461125, "uuid": "bfc843c6-710e-4c4b-abe2-22e9a3c4eb51", "comment": "Malware payload (Mirai)", "value": "08a076c629886664d36f66b721ce0a73ed93eed25f57d2e78a56c305884e9af1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461125, "uuid": "edd07eb5-ed58-4187-8957-d70088130518", "comment": "Malware payload (Mirai)", "value": "06c07215b2bb1c9eda472fb3c6bd38174f5242df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461125, "uuid": "9aa3b1f0-49a5-49a2-a0ed-7dc068cbee8f", "comment": "Malware payload (Mirai)", "value": "3ca80de78ec345c910b5eb3e1f2396811c322348851f1e2a4a3c5e1f5c07e347b020d2d91174c58a17e2b336e9f162b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461125, "uuid": "dfeb0b8d-e829-47ba-93dd-a87afe2caa7c", "value": "T1B4B329C0F98B81F6C40B8C306166F63FDE31D5A94171DAADEF959F36EA37602920264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461125, "uuid": "b2edca11-7f39-4a8c-ba5e-794532c3e2c1", "value": "3072:fTm/iNJ65Sfe/CsFuT09dZJeTMUfnDHGKgpuzFlo1OD:q/ij6i8CsMTMXQ9KcQ8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764461125, "uuid": "8d3dc7b0-60fe-4713-8f42-7b4cdbfde2df", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764461125, "uuid": "19b1a502-b9e4-438c-8c36-6d68f0db82a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461125, "uuid": "bc29c69e-73d1-4267-b1a5-14d81fdfedf5", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d133bd00-cda9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764478969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478969, "uuid": "15bd4588-133f-4939-ac7b-534cbbd66a45", "comment": "Malware payload (Mirai)", "value": "eb175c5a4aab89d381c32f94533f62ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478969, "uuid": "d7ec77a3-2ada-4fb6-8862-164f504aab85", "comment": "Malware payload (Mirai)", "value": "08c62908c03fae070537287eb377e8ed1bfb74ac5a724e8dcf041896fe7f82fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478969, "uuid": "2fe92f97-0dcb-4a13-8488-f3ad3999ae48", "comment": "Malware payload (Mirai)", "value": "4c30bf773888cc995172e2d63d3966b54ba63d70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478969, "uuid": "6665c972-985a-425c-b6da-3eca0dfe129f", "comment": "Malware payload (Mirai)", "value": "08932f29b8dc4abef6bb498ffebb0ff55f2b34a3b6798f43cfc63ec0848d00c07196d5481c56cdd956a0b8a140d93927", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478969, "uuid": "d026fde5-7a3a-4a4d-8c95-a9437239e2f9", "value": "T15643F289ED56CC1ED7FB7A4E276285C296C1196E77F2B4B456C8AF31082721F039C4D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478969, "uuid": "e88b711c-67ac-4dc1-a02d-13ca721ce4d7", "value": "1536:Kx3Y/CdfAhWgAFXFzL3zAzttiMLKLKYKYI4u+qgw0Vu9:KqWACXFP3UiMLKLKD34u+qgw2u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764478969, "uuid": "76589823-0d17-49bf-83a5-f8ceed964ea0", "value": 57464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764478969, "uuid": "25732315-fbf5-453a-bbc9-14b6e2b02e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478969, "uuid": "ac927469-7a30-43af-aafe-d1385adf4eeb", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a18a482-cda8-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764478205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478205, "uuid": "7a89432c-ece2-41ca-bd30-b4e3c294b3f2", "comment": "Malware payload (Loki)", "value": "12a26549ee23193b6c1992997d76ddf6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478205, "uuid": "811274d5-ce9a-4787-8b4e-733dd024608a", "comment": "Malware payload (Loki)", "value": "09cb27389f9fbf62d23177d78f7e5dbb7f8f07fddc2a68f95fd607987ff0b8b1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478205, "uuid": "68203160-21b7-403b-a7a3-c5f49e483d27", "comment": "Malware payload (Loki)", "value": "8977529a566c7794c90144373496c53e50b2810b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478205, "uuid": "5e7b4f87-fe63-4f42-bc34-819f9b660b53", "comment": "Malware payload (Loki)", "value": "ecd49848d214432410846e83011cfe27301b4ad7157962bfc6619892a16b38fc772db8c9638fa50bb6e14e6534ec2eee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478205, "uuid": "408ea194-896c-4ba7-b55b-421febb603aa", "value": "T1B3D3D07974B5E817F561C1300EB7C9BAF729BC486CC2410727173F2D293A2E98B66B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478205, "uuid": "dd38240f-99f5-4e6f-8cb9-698729cacb8b", "value": "1536:7ZnSJw/pTzPW825yNcd5KSywwFm9srGZUjUEPGyY8Olr+JLtiVNklIycn91BxksL:NH/pTzyqtdQ2YJlAZiV8TtXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764478205, "uuid": "44bb9391-e97d-4f43-ad21-b8d737ff931e", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764478205, "uuid": "2a84fcc6-de87-4fe7-aa30-0daea2d947b2", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478205, "uuid": "35ab3e4b-6b2d-491f-8a80-d150434ebe54", "value": "Payment.details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bbafca-cdf6-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764512022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512022, "uuid": "074791e2-461c-4730-92cc-0ab57560c872", "comment": "Malware payload (MaskGramStealer)", "value": "e878bad845dfbd1c1cd2f7f0512c7756", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512022, "uuid": "8d98c17f-c21d-4ee1-8bb5-a0099b324d40", "comment": "Malware payload (MaskGramStealer)", "value": "0a04210eaf96a610c6b570186e42cdaa70082bfeec187a8d7fbc0ee1a3f937f1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512022, "uuid": "2351e74d-6dc4-48f5-8b84-a9ecda0f1ad0", "comment": "Malware payload (MaskGramStealer)", "value": "196bdb5041896f981a7edcf537d508e06cad4267", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512022, "uuid": "ba696351-e9b7-4019-af83-c29bf8a79e54", "comment": "Malware payload (MaskGramStealer)", "value": "6169f321a409ae1ad710301e8759124486595cd19100ed7d80f4246344170940f315724823f3eee0b0de0af624079399", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512022, "uuid": "1f4e4ce0-a89a-4d23-881c-eefd890a8ec4", "value": "T1E7A502A94868C8BADE143CB1B1387A9D51D7BEF77CA059E4CEB2754BD0F2C2870CA451", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512022, "uuid": "e9929883-7941-46a5-82be-eb12a86c44a7", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512022, "uuid": "fd62a9ad-a2c1-49ce-8727-def7f3a59da7", "value": "49152:tEOGPox93cH+K0gmANLHTChBDlfCRCOJLarYYAIAXRJmixIOz:+Ob5JgLN7TOZfoBgYTBJmtOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764512022, "uuid": "b98e3b96-5dda-4fb1-ab64-26f7d9852d9c", "value": 2153472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764512022, "uuid": "c87d6bff-29b3-44db-8834-8a7ebb402b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512022, "uuid": "236a9181-4e6e-49f7-8708-588ece355474", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dca2a3-cdc8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764492137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764492137, "uuid": "672493e6-7a1a-46cb-9c07-bb52fe1240fd", "comment": "Malware payload", "value": "81657c06a0b0ef280132062c08488d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Winlocker", "colour": "#A51C7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764492137, "uuid": "266036b9-0508-457e-8e48-cd03a407e9f2", "comment": "Malware payload", "value": "0bc7e12348ca36df7d5e457cdec234b539e1d791a96baebf147e5be568949074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Winlocker", "colour": "#A51C7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764492137, "uuid": "4c22d07b-8591-4e81-b565-2124e92cbaaf", "comment": "Malware payload", "value": "f6eb2835149851549b29d27a0d5405d4edb5175e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Winlocker", "colour": "#A51C7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764492137, "uuid": "faf0ed4d-099b-469d-899b-ab6c8c4bab5c", "comment": "Malware payload", "value": "246640aea354a8cd1f6a83531e3040e2fcd77e8935685693e4a619cfe80c8cc42aa3ff6ca2f839fe51a174bb52479e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Winlocker", "colour": "#A51C7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764492137, "uuid": "ad95ff92-2f72-4f98-a334-926aa4a0c438", "value": "T15A938C41B3E642F7E6F2083200F6712F9635AA289754DED7C34D39525E42AD1AB383F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764492137, "uuid": "ce5311f0-46ed-4964-aeb8-0299400eaeb6", "value": "a8f9817be32c1d5589680a5066ebff5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764492137, "uuid": "eb1a041c-def9-48fb-81db-49089f460620", "value": "1536:I7fy7CyfphIMvMpICdHkXMXakLC5PNNg1qCXxaIOlnToIfl5x6uKLs:GamXeCtkCubJCXxoNTBflLcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764492137, "uuid": "ccb6e464-6efd-47bd-a615-599f64949f92", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764492137, "uuid": "dcac2809-f51d-4ad1-a737-937a1a3df19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764492137, "uuid": "01871b45-2762-499b-911f-a69416bb34d5", "value": "GenaLocker 1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52642c5d-cd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764467159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467159, "uuid": "7eb799e3-6069-470f-b9d8-eec870eacba7", "comment": "Malware payload (njrat)", "value": "16a8e7c990a1f22d35d62fda3ca8896b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467159, "uuid": "bb6f40d6-5fc6-43cd-98b4-760866070a96", "comment": "Malware payload (njrat)", "value": "0c760af65d43e84151805fdb8976ec6f437cb17abef30a85a1e0941d49bed85f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467159, "uuid": "813e6387-7822-4aa2-ab7d-eb26ca52cf32", "comment": "Malware payload (njrat)", "value": "969ac6862b9f10e0d5fd5ef42cea492805d73a93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467159, "uuid": "08b3f4ba-7c36-4a69-b7a8-23074b072c41", "comment": "Malware payload (njrat)", "value": "f23aa6e8e18c2a180d118479affb70e76837ab11fb33e39e750409d2323453eafc743d3ee397f96e270258411674002a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467159, "uuid": "1b2c72bd-7265-4c17-86c8-9661d66cf8e3", "value": "T1D9847C5033F80A15F2BF8B75F872595587B2F82AA966E35E0C8550AD0E72B80ED11F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467159, "uuid": "d54b0b1b-2b51-4b91-b6c9-c595a07f3a16", "value": "6144:I9lgR9c7sKq59182SJcXq5EfUbNcK3+t8EKmhATbY:InrgKk8XE8ctH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764467159, "uuid": "2e06af88-9634-4841-9304-ae9d2329821d", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764467159, "uuid": "ac420225-3ecb-476b-a080-256ab7da5dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467159, "uuid": "b5012868-35e1-4b3b-a63c-7918dfee48c7", "value": "PearlClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057c0447-cdc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490653, "uuid": "0a1217ad-3a2d-49cf-bee1-9e4cb6b52eb4", "comment": "Malware payload", "value": "13d7bcea5564c298a708ec33b67f7b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490653, "uuid": "f4902546-789f-4f75-a294-2c69ada5fd7e", "comment": "Malware payload", "value": "0c95317a3bb6ad03569cf9c717307ca1e5d3ca0ba93c39f3e28838420c0bd8f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490653, "uuid": "3e23250b-9ecd-46ca-83a7-0cb3800c757d", "comment": "Malware payload", "value": "5c438c6573afbed69911b0062cb372f8ffff84f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490653, "uuid": "136a29f7-ed9b-4c63-ad95-31a06e7b4380", "comment": "Malware payload", "value": "817c0a255970ea44185d9b078339ab45ab81086b6ddec814f909722ce53453cdbc239bc9c9d222b7362452bf2548593c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490653, "uuid": "d60c979b-9c34-47a4-bde9-916f88d7eeaa", "value": "T1A12712227A8140B3F7630671557AFB7A95BEA7350B3895D383D00E29AD311C16A3B3F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490653, "uuid": "b520e2da-8df0-4165-9098-7d81df163a6f", "value": "c6f7663c817aa61f1369d2431783ddd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490653, "uuid": "b8e38d35-e950-4823-9a2e-384290055fb2", "value": "393216:oA1c7w1KPQrfD6CuEn/J1Tvzi4fC5669G4eTsSpcRwugtOdqvvo:ozsKPs7J1TvrC56699eTZ+skdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490653, "uuid": "36138f24-5c1c-4533-84f3-c19257a88440", "value": 21240352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490653, "uuid": "c01f10aa-6ffe-482f-b8fb-8ed65ade3592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490653, "uuid": "0d3886c9-313d-487f-a246-97b93fc25fae", "value": "\u00c3\u00a5\u00c2\u00a5\u00c2\u0087\u00c3\u00a5\u00c2\u00a6\u00c2\u0099\u00c3%...~311~...\ufffd\u00c2\u00a8_2_10004379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67570df-cd88-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764464777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464777, "uuid": "58902e1f-d0f4-4c6b-9ca7-f0ecb2462aca", "comment": "Malware payload (Vidar)", "value": "5376daa28bfea0c28fee8e7edfa61f14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464777, "uuid": "d27d46bf-d20e-48ae-8ad9-3b399bd0e2e5", "comment": "Malware payload (Vidar)", "value": "0d6c8f8cc6762987d9041f1dabdf00fedd2b4961a17cab0cf5650c7094f41a9f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464777, "uuid": "b5f0d440-2111-467d-b3a0-765d49bd464b", "comment": "Malware payload (Vidar)", "value": "c438acfcf500aee3b20e8d16baa1048f4f4ce910", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464777, "uuid": "1b9030b0-a9ba-4520-838c-598c7de91ad6", "comment": "Malware payload (Vidar)", "value": "ebb68910fefbdaac0ff707f7049e0113c4f12cfeb8fff3b35f16e702333f0c8dcd4ec1914fe760db8180692296417ace", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464777, "uuid": "d279cbcd-b558-4f51-880b-d73accc2ae2d", "value": "T187752392F7A050F9E077417889A20617EBB2786503615BCF07788A7ADF137E19D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464777, "uuid": "8f4a7ad3-8056-4393-bab1-629937f58d8b", "value": "00ec1f9addbab7dd7a563fe6fe9caf72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464777, "uuid": "e3dcd435-6daf-4a83-a387-f81909aa22ba", "value": "24576:ycx43qz/vQCk0eGnEy5IpM2aEi4ON3y0txSx+BZl2+iXOtkmEH5WnWJHbaeKx+Ep:F4eVk0/nvIpMfION39tw8Zl2TSS7s+Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764464777, "uuid": "9bb84d45-9dfb-4c3f-a913-4ec5e8e4f115", "value": 1554211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764464777, "uuid": "4d63465a-bae4-4030-b174-f36483edfb91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464777, "uuid": "e880d0af-978d-41b6-a330-34254ef867e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647b506f-cdfe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764515293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764515293, "uuid": "3caf382d-3926-4e85-8c97-7dc828da536d", "comment": "Malware payload (Mirai)", "value": "0036fdc9fcf953b7c1184d91f0d9d2a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764515293, "uuid": "7e6c21b9-b3be-4a39-9743-79b0884ad8ca", "comment": "Malware payload (Mirai)", "value": "0e1a78d6bdc2a3ca9791e230759862558d237af50914ca2b67b4854352d3077a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764515293, "uuid": "e1d92b75-d1bb-42f8-98f1-a2a044af3d32", "comment": "Malware payload (Mirai)", "value": "a16df32218364b9b1adfc79033336eaa3707dc98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764515293, "uuid": "a3297454-25d5-4e25-8ef9-8d280011f341", "comment": "Malware payload (Mirai)", "value": "e8e21e5fc0d9d1e879cc782e79f065a6146a334fe184c0f9ed71883c10b681edef6fc0c81da6db64bf45b4092a1eb678", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764515293, "uuid": "c57c6db0-b349-4efc-af27-640812a09340", "value": "T156B339C1BA43D4F5EC1641307177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764515293, "uuid": "7b852c75-389c-4c9c-9598-86f910172bae", "value": "3072:PbDW4dCLFaGFBu3/45g1rcV2wTzSr9bMFflc:PbS4doYGFB0/45gdL9ulc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764515293, "uuid": "6eb9276c-d5dd-4fb0-b1dd-ce69d978d31a", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764515293, "uuid": "03c35e85-8167-4e7a-9183-98efcc9f4ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764515293, "uuid": "5630aeaa-5525-4b35-9b59-d61ce1afba66", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e077c253-cdc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764491450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491450, "uuid": "1745b097-3724-4b5f-bcd7-6785fcd201e7", "comment": "Malware payload (Mirai)", "value": "618e684986ae673754b306982539506c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491450, "uuid": "e0b36841-6065-4d8d-a51b-968750b0e21b", "comment": "Malware payload (Mirai)", "value": "0ec4d643612cf95c9ae27d92eacfaca957338efc452db03931b2c32c60de1c15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491450, "uuid": "77e30324-0580-43a0-b44d-3c4ff5c8989a", "comment": "Malware payload (Mirai)", "value": "fc66998e9ec4ba47587ab125b0e42176aaeb5741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491450, "uuid": "b01e9f48-d488-463c-a70c-5040abd204f2", "comment": "Malware payload (Mirai)", "value": "3994187f81f4896073d98361f16758fdbd870a5c00e0c4c3ce99ff669a0e460db049617c20daff747c62059cc4bbed1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491450, "uuid": "e21d27e8-42d7-4eac-9c5f-6f22b6760c72", "value": "T1014412B3C639E3EAF471E4B0B66C23CC101462D9C958BAA0774C54661B5439B1B6F3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491450, "uuid": "9c898777-adb6-45cc-b981-a64a301368d5", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPto:2IIKXhZtL7jOTyIG87X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764491450, "uuid": "b85d2ee6-7e4a-44b2-b1b6-de4ecbf135a5", "value": 255612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764491450, "uuid": "51ffae5d-a049-4cc0-a322-2efb0a61ab34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491450, "uuid": "b3b0c197-d869-43c9-b5eb-0d593d093792", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3b3453-ce02-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764517209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517209, "uuid": "6e6c3426-73bd-4f85-bdc9-e49ad560db13", "comment": "Malware payload (LummaStealer)", "value": "15f33a5f2bf75fea1cf96a4b6ab48af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517209, "uuid": "b96fae91-80c0-4ee1-a589-b7acfdbe1b41", "comment": "Malware payload (LummaStealer)", "value": "0f971ac499a0f9a89069c8544c88765ac9f2ffd52aa7e29b15b586c6baecd6d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517209, "uuid": "424209e1-1aca-468a-a08f-e1b470a63eb3", "comment": "Malware payload (LummaStealer)", "value": "8fae46ab22baeee5ee35497cb05915472091d02b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517209, "uuid": "d9e23341-6e3a-4afa-b8cf-206576f1d4f4", "comment": "Malware payload (LummaStealer)", "value": "e8a2f122e70b2011299b55541b9911b4a5828edbf5334f8c3f4e7f5c215687397ea26f6cc8d7a083bfe672d1adb0020e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517209, "uuid": "377cbc63-ea99-483e-8ad6-368ccb144348", "value": "T15F84AD01B9C2C0F2D823113249E9E77A5F797A35C961CDCBFBD41D69CA76280A31A35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517209, "uuid": "01ae54da-9561-4685-99c4-0fd4fb41d2fa", "value": "7e2df31d3619106ad25b94113e9b63d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517209, "uuid": "56019aee-5038-4c05-a747-3a237e3183e4", "value": "6144:obPLF9Ocyp/5ci5NkcR3KT8MnIpwW1lSbxzlYK+bZxUn6erkA4uWSi711KTlgvVT:orRUci5NB3EIblSbn6xWrk0WSi71zBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764517209, "uuid": "88268504-3331-4753-a30d-b04af8afb235", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764517209, "uuid": "eb0c418e-6ffd-44d7-b6d7-8cf99ae82686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517209, "uuid": "a9c956ce-4b83-4c0f-b473-ea6e9995e90d", "value": "15F33A5F2BF75FEA1CF96A4B6AB48AF7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038d601d-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764540042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540042, "uuid": "4412445d-2288-40e6-85cd-315367757ebf", "comment": "Malware payload", "value": "5ce8b9387663d9a1d154b2e3005c45b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540042, "uuid": "2edc5bc0-f07c-43ec-a616-169fa55eb36d", "comment": "Malware payload", "value": "11baf8f103e7eadb836c27f71ed75f8e86e456a1c24d53fb85da3d199640444c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540042, "uuid": "f17a6479-8484-4409-bb34-50c03bc3efe3", "comment": "Malware payload", "value": "3d96c9afce367b314df5cdd30b443e23e806b3ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540042, "uuid": "f32d309d-2b37-4c0a-b2b6-28ab4613741f", "comment": "Malware payload", "value": "b87cfed1b299099941e50d312b8ad5b967d5aee443d1c5081f19c3b320252293fbe50e1bbc9312a819f8545ed950a7b7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540042, "uuid": "d0f04c9d-195d-43a3-9a82-bbdaf8b6b5cc", "value": "T1DE63E13B0027B49F39684FAC59362D518EBE59C2112C956EDCCD90AFFAED8784C4DA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540042, "uuid": "bf63edb5-7a16-420a-a832-d13533fc5310", "value": "1536:ETsyouP2c69gPTKedyFwSiw/z2LNtpHZuOPQv8pDwwQNmKaXhjk:P0/eXiwiNtxpi9KA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540042, "uuid": "dc1948db-9475-46b6-b94b-f345e3bf0305", "value": 67112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540042, "uuid": "84ede0e4-097b-4320-ad6a-020480bfcf0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540042, "uuid": "6f914c74-24bf-4e13-bf7e-ebdf5b2ac173", "value": "boot64x.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403510b1-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540143, "uuid": "0dfec955-dc20-42b8-a17a-6e336f8d826f", "comment": "Malware payload (Mirai)", "value": "f0df8da5144be93a8911dbab56d771e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540143, "uuid": "2f0744aa-f3bf-4d3b-96ef-43024f92d4c0", "comment": "Malware payload (Mirai)", "value": "125a8c3728666c4b81134317f0c35dd5a9c8461b6fb7491d742a556f35f9b545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540143, "uuid": "d4d2b5a2-c901-42f6-9ffc-e1c4d4e68ba8", "comment": "Malware payload (Mirai)", "value": "b77e591aac689bc61af50bd7deda3d2242fdcd52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540143, "uuid": "7fd2444d-1bec-41e1-b577-f5b236befc1d", "comment": "Malware payload (Mirai)", "value": "38872cbeeb933b1d40699bcd9e0def79539bcb08fd3ba63f7d080f13383753b5c2bd189aea23a6935e7fb0294cedcc78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540143, "uuid": "b8aa8af7-7c98-40f6-8ab3-fb0bc9c3f262", "value": "T1EB2308C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540143, "uuid": "06eede7c-3f1b-44e6-9957-da72c999cc5d", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AG+1pa/4Qw7bn2ige:Gv4QPfZfW5XTOeoEzG0AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540143, "uuid": "7dfea704-5229-4ebd-b6f6-7ba22151a543", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540143, "uuid": "d3b3af5f-a050-4a83-9633-1a6a9cb6276b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540143, "uuid": "4b3f9529-6e5e-4f93-be18-b674f75b1dd8", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e838b-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496761, "uuid": "093c3fba-0174-47a4-b69c-78a10eb5645d", "comment": "Malware payload (Mirai)", "value": "0d3f433e3946e5b3e4ad4bae2301cf6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496761, "uuid": "f29df2a8-86bb-4715-8197-f61493f7e500", "comment": "Malware payload (Mirai)", "value": "14584e8e66d5d071aa9cb39838e4e3c4abe8ec783ea5438b651b7ea52c99398f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496761, "uuid": "e0030c05-1c90-419f-a9b6-f5d8e072e188", "comment": "Malware payload (Mirai)", "value": "96560447f0904e0e4a4abbdb4bde26d0b59f9c0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496761, "uuid": "9c4101c0-afa0-4495-ae3d-7331bca02554", "comment": "Malware payload (Mirai)", "value": "bb1edab83d74d632186e2a580f76c4bc087da1a3691673d8a6046eb3250b7ee613c063dfaf96493338de85cb0aa76b3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496761, "uuid": "f5b97e1f-5841-4d1c-a5b8-268d871d89c6", "value": "T1DEF32981F9414F27C6C712BBFB9E428D3B2A13A9D3EA7103DD215F203B8695B0D7A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496761, "uuid": "db43edf1-64be-4c0c-b585-576e7007ef2e", "value": "3072:tQC7toK0cm5aWW/i4SXdAcTvEG7kJ6hh19OM7:tQ2PoDUi4sd1T80kmOM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496761, "uuid": "f5671270-cd23-4d7a-87f8-9d23f903850d", "value": 158848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496761, "uuid": "b5c05a1f-ffe1-4103-ad73-a8d82343115e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496761, "uuid": "3fde72cf-94f7-4517-ade3-99dc180a1c7a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184d2934-ce21-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764530198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530198, "uuid": "d08ecc00-8895-48ef-b0e9-904a013456c1", "comment": "Malware payload", "value": "0c1c2f10152525eb08f8567ce7d14438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530198, "uuid": "e780b1c2-3f2a-46af-a600-2254407faa45", "comment": "Malware payload", "value": "14faf57d8d44a7654d95ebc54fa00ba28b041bacd39b3a96379d69ebbf56318a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530198, "uuid": "e5d98b3b-41f2-4707-a9d3-84be48944e07", "comment": "Malware payload", "value": "bae90838cf2f00020a49e327d1aaada4d159da11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530198, "uuid": "9f6265bf-5a29-4585-80bd-e111c099ad97", "comment": "Malware payload", "value": "a57ea6c566341e0cb66edc9279edc1522a5fc5bc817b4c155bdede25dd58628aaaf342eae2eb4e2a6643ab53d8c71bfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530198, "uuid": "e2947085-0e70-4d62-b177-d14e5df38bc4", "value": "T163445C2BF397A8BCD5638038E98A93723831BC182325B96F21D9DB723D539241F65F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530198, "uuid": "3dc054b7-daaa-43c8-8ef2-d3969605e425", "value": "3f94115c31c8c3ac4f4b0b8f7310fbaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530198, "uuid": "db73b45d-119a-4091-a83a-648101bbad0a", "value": "3072:6a2xyhKnl7veInkVcys9ku/24s9AxQq8q3zcOdVA84dh+WfafjUNB/7N1V:6VUKnl7vuts3/2hPWcJdh+nUNjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530198, "uuid": "b53f6ccf-6c64-474b-838b-f76e484c7dcd", "value": 276016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530198, "uuid": "eb4b08e8-c134-488f-adc0-1da692199f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530198, "uuid": "3f1551e3-7ba2-46bb-b868-e4eb3d73077b", "value": "1khq6tfxfvrk4vx6mj3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415f700f-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540145, "uuid": "c65ad063-1bb4-4b0f-863f-90704d06bcce", "comment": "Malware payload (Mirai)", "value": "8f473d879b7d1b2be3b39140498249d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540145, "uuid": "c903e3d2-c391-4554-9fbb-3494cf62f298", "comment": "Malware payload (Mirai)", "value": "15d8ba60dc6f028f00671e1e643f12fee7d987b2f2e6b63bcae921b9d175aeab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540145, "uuid": "31320ddf-411d-4dba-8727-f572b931b40f", "comment": "Malware payload (Mirai)", "value": "745dd9eaca92a1335a2cbb4c4b2b140fa4e79bfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540145, "uuid": "a8fdf31a-0d81-4437-a5de-dc77343f6b63", "comment": "Malware payload (Mirai)", "value": "25680bded9d1ad5119e783fa4163224fcf61c4fd9bbe2b34f084fbd002fe625fcd991932638e9590e1ccf468d1f800b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540145, "uuid": "f663b4db-a616-4c01-b1ef-4a5910944a25", "value": "T1A9438D36E86A5E24C44D027074649E752B63E1C493872EFB19AAC27DA483E9DF504FFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540145, "uuid": "518db862-daf5-40f0-a274-a6eac08c4493", "value": "1536:janmM/K1P1mdP6/jHhKNVa1pwIaDCiYsJWW:jAmMi1Po8INCwIaDlJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540145, "uuid": "bd6b19ba-1f6e-48f1-a006-890929ad1d96", "value": 56284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540145, "uuid": "f3a069d1-29f1-499a-82ec-753e89bf2b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540145, "uuid": "c38fa5de-814f-4a9d-8750-c763ed7333b8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a50c909-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496728, "uuid": "450bd143-403e-444a-9a04-e88968044553", "comment": "Malware payload (Mirai)", "value": "fcb3e76e5238cb2255d396ac5a22adfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496728, "uuid": "ccb5ccd0-3ce6-41bf-b584-895777786cfb", "comment": "Malware payload (Mirai)", "value": "1643e9e1eb220a3cd9b796dda3a9e119be9b2a96a9b5b38dcac7ba8b91f8d895", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496728, "uuid": "7bb620e7-25c6-4755-8319-9cb288096ebb", "comment": "Malware payload (Mirai)", "value": "b62badf597fce51780ba353c0175a7197461f752", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496728, "uuid": "c451aac8-afce-438a-8d60-35b1282582f9", "comment": "Malware payload (Mirai)", "value": "dea0ae42c95e0f2d462c586759342ee5d13d3be946554332bb039462239d29696c27184b006f396008ccf0f55f1d81eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496728, "uuid": "34928ecd-dc8f-473c-b77b-6c8340080f6b", "value": "T100730209244DD111FF120B7688A528CD8841AD9590AEB1EF312A5F39D8CFDA32DBFD96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496728, "uuid": "1f61fb55-d173-4d12-b192-5420b256263d", "value": "1536:i8IHq+kgs7VI83wgrzlEFSPO/hcoiisjuq5Z14ODCnLtBcGXUqh9+sadEO3dzzUd:NIHq+kOQwgrBEEO/h7iF6q5v4YQL05DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496728, "uuid": "d2e4cde0-75e8-49e7-85d6-e57d698ec73b", "value": 77216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496728, "uuid": "ae648fc2-d4ab-4059-a714-bd3966526d6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496728, "uuid": "0487db7e-a393-479a-8634-439d68447a5b", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a66a60-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468183, "uuid": "596528b1-76ff-4e28-88f1-72b42f143d2c", "comment": "Malware payload", "value": "696588e1d8520dac7dcdd25c4cd2a2c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468183, "uuid": "911462c3-8498-48dc-97cc-c1665c55714b", "comment": "Malware payload", "value": "16ebf82f00bc0105348c208b7a2b2fcf9eb775e7adc23bf2744c001bf9b15fc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468183, "uuid": "a26493c2-db64-4a4a-83ff-ee795e25ec89", "comment": "Malware payload", "value": "b0984fe4fd896b6cb57a8cb01218c6c57df9dfa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468183, "uuid": "f45c10f4-f0ea-463d-b54a-8297da02ed61", "comment": "Malware payload", "value": "367c2606ab099a7e91dc3fe5546d8e76c27d5bd8248af9e3844ad44fa3b6d046cce088ce37ab7d314c3d3ad172206801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468183, "uuid": "8b4c7557-2309-4b28-a8a9-0ddcb16b953c", "value": "T16275339E840167E76A14E25F70686CF323943E878FC3256664EEF5E1D6B3CDE6205283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468183, "uuid": "7c88a81e-c789-413f-a1b2-8479ca80eb3c", "value": "49152:jFGTdrclfSYV9jTL/0cL+RFKbyry71p67zyaEN7LPDy:5djVxshgglEVze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468183, "uuid": "05e2181d-ce5e-449f-8dae-90a66f2d502b", "value": 1625968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468183, "uuid": "a6edbfa5-8318-4186-add2-3e07a3812f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468183, "uuid": "2e2cc772-3be1-41c3-ace8-079c57e7e062", "value": "bizy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5350b074-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764530727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530727, "uuid": "63785095-0b1a-4bc0-91db-99661528ad6e", "comment": "Malware payload (AsyncRAT)", "value": "11532619ca9fd44b140cb7ef7b69476d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530727, "uuid": "be7f5390-cbb0-4d0a-b3f5-6811f9919874", "comment": "Malware payload (AsyncRAT)", "value": "17cb673e636e991b3df0929c5704022acc9491a3a63d4375b3f8a063ab5eafba", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530727, "uuid": "1a15ab67-4916-496d-b425-9b869f0d34b3", "comment": "Malware payload (AsyncRAT)", "value": "52a704748baf3d1c13e5ded1c814bab4a4df645f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530727, "uuid": "a3fa8f46-8868-402c-b456-ea4b67cc22f7", "comment": "Malware payload (AsyncRAT)", "value": "fdf09585ace4381b1cd9b80cb06080307c6ecc17eeaf8b0aebd78558b63180bad45f9db2333e43f74c362fa913ccd2fc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530727, "uuid": "15c412f7-6997-46cc-8430-bb6eb0bf0b60", "value": "T1B5E22A4877A44712DAEEAFB12DF262061270D51BD923EF9E0CE485E62B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530727, "uuid": "65c15ed5-43af-458f-accb-28c6007dfa22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530727, "uuid": "493f971b-ea34-4715-a4e9-c2defc5f2159", "value": "384:QlRmhGD91SluSWhnHHxzLmYV3Tm2eaFO6pzRApkFTBLTsOZwpGd2v99IkuiszVFA:kRPD9OQhx/BV3Tw4fpzVFE9jiOjhPb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530727, "uuid": "e4353410-a58f-4361-a80e-313b08f61ab9", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530727, "uuid": "cf9c0692-9f7a-41ac-9e35-37af9ee1201e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530727, "uuid": "b85bb912-2815-4f1b-a29b-422bfd579f8c", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb54279e-cd81-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764461779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461779, "uuid": "5ce6f406-8533-4128-b14f-b6652e1193d7", "comment": "Malware payload", "value": "4847279d66328b51e0f51985f721103f", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "letsvpn-mobi", "colour": "#494529", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461779, "uuid": "d2c05a90-4af1-43b0-99d0-3b928bfe7fe0", "comment": "Malware payload", "value": "17cf51bac57b3b0ab5a3e075d12cfa2e6113a49e5ec1c4dc414fe0dd37c05e98", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "letsvpn-mobi", "colour": "#494529", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461779, "uuid": "41d5065e-42bc-46ef-a1a4-958c78034ad0", "comment": "Malware payload", "value": "8a51afe550d5daaee32671c188f275c0836e6113", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "letsvpn-mobi", "colour": "#494529", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461779, "uuid": "8fbb0e7b-55ec-4df0-b37e-752fd65098fb", "comment": "Malware payload", "value": "7250db9fc4a8eb1a81d02afc77fa036dd7deb0eaff11fdf41f9ab2136228ad19644fb4f6b1e07999e9cd326117a02054", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "letsvpn-mobi", "colour": "#494529", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461779, "uuid": "c6acfc9a-d618-4a39-9540-9c1bad77ee63", "value": "T109573323B3C7A93FF19E1B3605B3B55954FBBA42A853BC1686E444ECCE250141C7EB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461779, "uuid": "5f3bcce2-236b-4bbd-ab7c-9357f803c5e3", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461779, "uuid": "853c2914-f704-44a4-bb3e-862f03886240", "value": "786432:I38nGsPnqWWXCl6Vv5S0bdKOROUE0AATcMuU:IMGmnqPX715S0bVOd0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764461779, "uuid": "fde828cc-0d1d-4b33-a40c-8ff616b382bd", "value": 27659638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764461779, "uuid": "4e844e07-b1ff-4e48-807d-03f5a03ba05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461779, "uuid": "65e2b558-ede9-4373-872f-51184653eb74", "value": "lets-world.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f6d700-cde1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764503052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764503052, "uuid": "3f5d348b-3723-4cca-8d4f-22dea39a727d", "comment": "Malware payload", "value": "e92779b57d821d0504b3c0841016b0c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764503052, "uuid": "beaa2bfe-a56e-4bb7-9b0b-b6d256c11549", "comment": "Malware payload", "value": "17fbcdd2644125a2d50c9d67498a081c4bcbf3d08b43a4586b876477cf418a5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764503052, "uuid": "e377e5a3-97d5-4327-9db9-3ebe166d3491", "comment": "Malware payload", "value": "dcc2f0d18fda3ce1163e4c30c46bfaf2458a92b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764503052, "uuid": "e37de3bd-eb3b-4eec-9a48-38043ee6644c", "comment": "Malware payload", "value": "2b08318e9043188b5573d24dc4ede5d25f5d770d3d4bacb54d84e4f6a001abc429398b4b1e981d64c876245539d1b7df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764503052, "uuid": "d0dfbb36-ab2f-491d-a9b3-95878d02b389", "value": "T14E438D76C47EAE94C19C85B4A8708A7A1F03F501D2963EF75A85C9A94043EBCF61E7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764503052, "uuid": "a31da3fb-4795-4265-a552-566b77d19c15", "value": "1536:+amwtQg4yrRRNPa0B8hnxUTQ5bWjZ1KCLHug7R:+5a4WR5pT2bq1KIug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764503052, "uuid": "44b91004-9057-4ad5-95ac-ecad4045f459", "value": 55780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764503052, "uuid": "d5b978b5-41d9-428a-ba99-a9f45657b874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764503052, "uuid": "be5efc6c-e4ce-415e-8476-e230a28d8815", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e120a6f-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538798, "uuid": "bed239e9-e3f3-4830-b8c4-cc70713c388b", "comment": "Malware payload (Mirai)", "value": "62d295b0feb6257d528e3c240ddc21d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538798, "uuid": "fe400cc4-61ee-415c-a5c4-f3f56fc6519b", "comment": "Malware payload (Mirai)", "value": "1a3e8ff1fe6a8aedab78c06803bd88300d97f3642433d1ae0039cbe3b6c1d0e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538798, "uuid": "89096144-3e9d-4005-b942-2b2042012438", "comment": "Malware payload (Mirai)", "value": "d7c6501e5724a83b7cee470f40943db502eabda4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538798, "uuid": "46c6027b-a6e3-451b-b98c-f0e0eb25cb49", "comment": "Malware payload (Mirai)", "value": "9f73ecf9777cf9c6b8eb99e428196c8a1334942c21ef5f3fc87e666d92de91f37835ae749eb7e34f485dddca41ee5be4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538798, "uuid": "c88312d4-79f1-4ffa-8d30-888b87d8cd44", "value": "T1D3D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538798, "uuid": "fd956f93-65d4-44eb-9b4a-29c644cbe583", "value": "3072:1oldeCsOs9kzj23V44qURgyXykV30Qm9Jlsb3jL4:6PeCK9kzi3VjqoymymbTL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538798, "uuid": "0edfa88f-12ab-4648-8b06-2ed13b818e3f", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538798, "uuid": "63f51cb3-ecb5-460c-a22d-6a95398da6d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538798, "uuid": "b5e75f65-565b-4864-a98f-8bd9bf0b2859", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caecaae-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540138, "uuid": "3c42d7b4-50bd-4325-985f-e95298fb8aca", "comment": "Malware payload (Mirai)", "value": "12d9c9c4cdc396af08dcc96e770de357", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540138, "uuid": "6795fb5c-62b7-461c-a1d9-3d06fb1991c4", "comment": "Malware payload (Mirai)", "value": "1a61cf235e11fba5a002ffaeffa14ee3db4548959ac52223c06eb711f6c6570c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540138, "uuid": "0304886a-11d2-4a96-acc3-ed55490aa321", "comment": "Malware payload (Mirai)", "value": "225deba2351ffd379ec4cceb3ba75a45a9c9fce8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540138, "uuid": "9e130f02-1b53-4d9d-8cc3-c7b302cc8ffc", "comment": "Malware payload (Mirai)", "value": "bddcc815e518167ffc04afb61a3336c272fe357b9b1bd5be072d6898bc9171b1cc8df98216a0e1d42a31ac801464b62b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540138, "uuid": "09789bcc-a927-47d5-b05b-db5cc4b55c23", "value": "T164739D52F8692E48D40552F47174CA3C8B93A58181871FBA39A3C77D9487EDCBE4A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540138, "uuid": "53bd538b-977b-4531-8ca8-693ec09e0867", "value": "1536:TlQHtJR93OetSi274Eb07CcDKINVoF9JL9k0VSS+tB:TSHtJX+eKsEb07IIO9lVXOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540138, "uuid": "daae0e0f-ee67-485c-b738-2901c1cc1271", "value": 75252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540138, "uuid": "bc9296a8-79b6-43f9-a7a9-896a20705899", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540138, "uuid": "aebf42ea-8a9d-4659-a177-a90153d49bae", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c089ce9-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540163, "uuid": "3341c73a-6e80-488f-83ea-dc1d3decb631", "comment": "Malware payload (Mirai)", "value": "ca08aa9d4a2d87d8187d368150a4aa67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540163, "uuid": "223019a2-feea-4a40-a070-64e465c16954", "comment": "Malware payload (Mirai)", "value": "1a934470ddf926a4ee9c7645b48064e15610f3cdd70a045ae775d9e009840c47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540163, "uuid": "c15b8706-1be3-4251-8785-a0cbb4725b62", "comment": "Malware payload (Mirai)", "value": "6e5fe952a06ccbc7c693b9eab922c7a175b0ce69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540163, "uuid": "3005f948-a182-4075-a01c-5b39b282e95f", "comment": "Malware payload (Mirai)", "value": "f78fcdf9c766a83cb6cc5042c0f3f2f1998f61897b06d2cea1e5f66e54c8267dfafc84d9d861a86b39127a940264603f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540163, "uuid": "86e516db-034a-41a3-9a35-33b1df824018", "value": "T13D734B55BCD19A03C5C251BBFB1F829D372613D9D1DA3203FD256B6D7A8B86A0E3B240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540163, "uuid": "30778318-0e8e-4119-9e02-b15f65618709", "value": "1536:NBB9aZtGRoiEvDj1vNSrecGCOlwV3XFUEjIu7dlk0MSSF0:2tRrDpvIrecBXFUnublMXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540163, "uuid": "0351b2e1-58da-44dd-9b02-1776b2e85bc8", "value": 79296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540163, "uuid": "8f0743fe-2282-4664-8310-54994f9d48ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540163, "uuid": "b9c831d6-44db-4c6a-8338-9240c79e9586", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456fcf59-cd8f-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1764467567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467567, "uuid": "8157caaa-0d45-4445-b95f-c6de9e721ea7", "comment": "Malware payload (SheetRAT)", "value": "ed0603acf731385751e3cff4a256a7cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467567, "uuid": "aef53cb0-45d8-4e1d-852e-004614b4a8c1", "comment": "Malware payload (SheetRAT)", "value": "1ac769d0fd8703089612994c94073c13786266d98a41d79c612317a3e98f5e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467567, "uuid": "b3c24a0e-2ae7-4491-ba9e-277b5c1c96a0", "comment": "Malware payload (SheetRAT)", "value": "c076f885c08b08a491f0abe31db68b2c808f142c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467567, "uuid": "fca2ae6f-f2e0-4069-987f-42981ba94f0e", "comment": "Malware payload (SheetRAT)", "value": "fb68953a17388b464c28c92f2dc87c10a354c3e65a2d2dfefee961b774a6e1d1be8b98e22ccd0f153c8c8b5a8515d602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467567, "uuid": "b96d069c-9337-491a-90d4-509293fa10c1", "value": "T1B5E4B30CFD61F811CE6E3DB38BE691A11B3210C63F129116370A6EFA9B543B659A317D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467567, "uuid": "25070860-73ba-4b40-8c86-f6c85de0929a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467567, "uuid": "c740a213-a16e-46cc-a3cb-e746e71a9295", "value": "6144:HVYijsfFsRpOeZFKsR45bwtZCd3r209WE0J9Ri83ovDbaZOYQ6NDbe+EeByIDzrg:yijc2JR4pa83p0J9vfZOq+e5ngJ7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764467567, "uuid": "fceb6cd3-b472-4493-a23e-69b58e56ae23", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764467567, "uuid": "54e660f0-d8c9-4d91-a533-2210ec7003b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467567, "uuid": "b8f5252d-afc3-421c-8a98-6dd66ea690d5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e73b537-cdd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764499365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499365, "uuid": "030c2659-ce48-4de9-a7c2-5b1cb5495f9b", "comment": "Malware payload (Mirai)", "value": "261b343ad079ade824f545cd90f3e49e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499365, "uuid": "05d439c7-874c-4b26-be33-09a2b7122dc1", "comment": "Malware payload (Mirai)", "value": "1b3bf4773ef4830f5d26827997171b30bea06019c4c1fef6a8614fdc0ed28e41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499365, "uuid": "686b5efa-0478-4237-ac90-fcd09d32e14d", "comment": "Malware payload (Mirai)", "value": "e6c1810929dd67caa6533048f33cd8001816e314", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499365, "uuid": "d2cca8d3-8616-454f-a1ca-15e9f3d90bce", "comment": "Malware payload (Mirai)", "value": "c8b132308fc6bec6f1c60565da05d0cce63a07261937ad156f144cb4f492f2c34973a57567a3741453af81a6e021df32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499365, "uuid": "72af6034-a6dd-4f02-884c-ef19367acbc2", "value": "T197E32756FD819F05D5D126BAFA5E528A33235BBCE3EE7112ED205B2123CA95F0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499365, "uuid": "87428272-061c-442d-b20e-d56bb00f0874", "value": "3072:Odl77hhp+NbmuGD0zEPsBasV3tk3keN3Mu+Z4ckIOL8HkeyU:0x+9dIkEUBasdtk3keNcu+Z0IM8HkeyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764499365, "uuid": "a970a2b6-2ae1-4635-a3ae-8672b279eb87", "value": 145088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764499365, "uuid": "47c81c39-2099-4797-88b1-0c06d2e0df10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499365, "uuid": "380918c7-6e1d-4f29-939e-a3da37e1d1f3", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306a024f-cd95-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764470109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764470109, "uuid": "9254c4a4-77ec-4c64-ba01-ca0b464269f3", "comment": "Malware payload (XWorm)", "value": "ea091dd19b2ee1e46a66a65c14fcdb32", "object_relation": "md5", "Tag": [ { "name": "178-16-55-70", "colour": "#BA797D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uyu-wantedrelief-com", "colour": "#092D69", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764470109, "uuid": "441d87a4-0507-476e-9ec1-105389ef2144", "comment": "Malware payload (XWorm)", "value": "1b659eb69213e00e8588523a42d3c04c62ece4cc9cbe762a7149c9f3d2eaca40", "object_relation": "sha256", "Tag": [ { "name": "178-16-55-70", "colour": "#BA797D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uyu-wantedrelief-com", "colour": "#092D69", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764470109, "uuid": "96e1e21d-c60e-46e3-b451-e85899175580", "comment": "Malware payload (XWorm)", "value": "5d70e172f4fde0f33afaaf691609fff971a169bc", "object_relation": "sha1", "Tag": [ { "name": "178-16-55-70", "colour": "#BA797D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uyu-wantedrelief-com", "colour": "#092D69", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764470109, "uuid": "1d2e6c2c-fe52-461d-84ce-8fd9b9dada2e", "comment": "Malware payload (XWorm)", "value": "6c03e300a7f1b9ecea5949062889e28c7f296303c41532c3335b6356cfe0cb789806105f6337d9473dd37cc789008f52", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-55-70", "colour": "#BA797D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uyu-wantedrelief-com", "colour": "#092D69", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764470109, "uuid": "d079fa2e-0c36-48eb-8912-1b51b4328f1c", "value": "T105752346377211FBE062523ECA560212FBB679280B728BAF17904265AF637D58D3DF30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764470109, "uuid": "2766e5ca-7844-4a0e-835c-773f1852a6ca", "value": "00ec1f9addbab7dd7a563fe6fe9caf72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764470109, "uuid": "b5dce4e7-0e8a-4b33-99f2-c41945c4a292", "value": "24576:yc75tNCj+Q6Hiq4ycBCBU6XIDcZ+5h9CVefcsn1+VE0ROnNjjdkYGDZvAiCrH:Rre+Gq4HoXIcI53pn1NeONvdqvAjrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764470109, "uuid": "9523b999-467f-4d4d-a5af-a0847fbea244", "value": 1559448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764470109, "uuid": "26f1381d-5dff-4665-a667-b45574dc808d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764470109, "uuid": "3851d306-2867-4382-adff-f4d83987092d", "value": "v3434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3d2ddf-cdab-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764479823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479823, "uuid": "915475b6-aea3-4769-8f02-4557cf8a9d4f", "comment": "Malware payload (Vidar)", "value": "7fe3c0cb0eca8f81a2190d975f9a2519", "object_relation": "md5", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479823, "uuid": "945c7d93-1282-4c87-a60f-b268a9eac8ef", "comment": "Malware payload (Vidar)", "value": "1c89d36d4d11e2c68995e38dd847c2c5b898713a68c3b066262f1feefbb4618e", "object_relation": "sha256", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479823, "uuid": "df4606a6-3a8c-4090-bb8a-2b788dfb90d2", "comment": "Malware payload (Vidar)", "value": "64efd67f5dcde1d1ac87c516e004e93bf217bb18", "object_relation": "sha1", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479823, "uuid": "52aa0cad-813f-4f4d-acc0-a6fa64b76815", "comment": "Malware payload (Vidar)", "value": "7a0c74ae5f07528d9c1576172be377059f0d5cbbaa11e583e96529d2d7564942ea3c8179c3036fe220ce6b3b7d675a61", "object_relation": "sha3-384", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479823, "uuid": "0e8d1454-638f-4f0e-8676-a7a48752a392", "value": "T163D533352BF42493EC695AB440F14067FB71B5D06F6D460F06A8E4FA4FA23C8A63935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479823, "uuid": "016f8866-274e-42ae-8878-7ee178529127", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479823, "uuid": "38e353bd-f912-4cd0-b84d-5aef915b80b4", "value": "49152:0bQhssgFlOOq2BNQj8D6wg7RvO1Mm6omp6clPJ0/qbledzbR4whPRw0D:KQhLLEY8WZ+MYQ60u/2i+CPRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764479823, "uuid": "3bccd06a-196e-409b-ac15-c1ce62f8eb12", "value": 2849672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764479823, "uuid": "de48ed59-135c-4d9a-adfb-726631f7fffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479823, "uuid": "a9e3defd-dafc-4dd6-b948-1dd0b8c93596", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448393ab-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764530702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530702, "uuid": "a2200da7-cf0b-4d1b-bb58-64f161714dac", "comment": "Malware payload (Mirai)", "value": "ab502eaecc8c43d04fd827ad7522161c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530702, "uuid": "fcf7b10c-d958-42a3-8e33-9630217e7ad0", "comment": "Malware payload (Mirai)", "value": "1ccc7a6643b13b8a50467630f4ee52db6505d7072267488fac8462caee08df5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530702, "uuid": "5e97d749-e5d5-4f4c-ab04-5ef3a1fbf529", "comment": "Malware payload (Mirai)", "value": "a2abba8c831bfce5a5ac2b8b08b57aafcf46d1b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530702, "uuid": "6907d1ba-c01c-4639-a137-3a709a2d8154", "comment": "Malware payload (Mirai)", "value": "d3d938dc5b16964257c7d264d6096b614693da0f3f3f23fdf81baa34b4f95fac1fe31c1c36e704610415f02ef7c5f787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530702, "uuid": "a112971e-29cc-487b-a134-5452444ee41f", "value": "T136C4394ABC808F51CAD53ABAFB5E82A873574B79D3E671059D140B3437CB96A0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530702, "uuid": "1221e0ec-6036-4715-b460-49ac2690089f", "value": "12288:YIYGtogDq5ZN4eAsK789ATkk4VXcJaHrcN48s8kHGXC7eD2U2GZc9ItBWFtoHCfE:Y2ogDWZN4eAK8qMDwPfSRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530702, "uuid": "68f405d2-3f97-4f71-9bab-682629411964", "value": 566816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530702, "uuid": "78bd984c-1d9d-407a-b211-562f3103e88e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530702, "uuid": "a31f78e5-cd5d-49b3-b47d-394fcc083d84", "value": "sync.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a5787e-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540151, "uuid": "71820c3b-7571-4049-a83d-57567bbd2268", "comment": "Malware payload (Mirai)", "value": "017d26ca4f7bdd0fad423972f0b911df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540151, "uuid": "a3870bb2-3da1-4a1a-bc60-ef029ad0f7ac", "comment": "Malware payload (Mirai)", "value": "1d1370980a2385a46faa1b2c7feec8018b535cd9218f0b657cebab55d0a8051a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540151, "uuid": "59f8d002-35b8-4bb1-a4c0-2ba1fa5447f6", "comment": "Malware payload (Mirai)", "value": "f02db7e9704f6ce9efb77e0684e931a57ffda408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540151, "uuid": "987b37b1-90ac-4321-8d3a-e1e794540a8a", "comment": "Malware payload (Mirai)", "value": "4664eaf90befab46c50694944fb7518dfbc68e0a009a0b3794fb855d45d654d749839402dc6a986bf2f35fbae73d9c71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540151, "uuid": "8643e8cf-a3ff-4d93-bd6b-a52e7365a4fd", "value": "T1C0637DC9D183D8FBE82B05746076EF6BAE72D4AA2118EB97D778C531FC51B02911398C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540151, "uuid": "f0d3a2ff-086d-494e-8f9c-19b935ab4931", "value": "1536:Ts+yItsahlUI7PDgIMjYA/2yx89qHXG5nE+vr3bhf1LF:Ts+yI2ahGILDgIMjYA/2yx8IH2q+TPLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540151, "uuid": "6f6cb38a-3286-4478-80fb-00a46212ea49", "value": 67696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540151, "uuid": "7081d258-cd60-4ffc-bdc0-dc8db978dd56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540151, "uuid": "5f009451-0db2-4ba0-8e1c-5906c3cdfda5", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a6fea2-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468188, "uuid": "a91ee3c9-436d-43f2-9026-ddfabdc1803a", "comment": "Malware payload", "value": "31c0e1ac933ff9f2a6306df5906345f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468188, "uuid": "e09d91cf-da68-462b-b91a-186362f98699", "comment": "Malware payload", "value": "1d71d8dd402e9cff4e742db2b32ad9e29925f19624f5168cb2419301e74b1b9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468188, "uuid": "3ca1e7f4-afa4-4365-9606-2cf614ce08ff", "comment": "Malware payload", "value": "b2cf81bade0a15a9ce8d2a1ea025c89b895652da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468188, "uuid": "472691f5-4a76-4224-86cf-9c6446280ce1", "comment": "Malware payload", "value": "e55bb9fd9eaf1780b5ee3a9fe43fb84c3e567e414a89d08896acbbfdfc7e194c91140c2be87e71e5a1e7d36fad48a62b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468188, "uuid": "c33731ee-ac41-4b92-bdb8-04e870d5a74a", "value": "T1E975335CF8015CA2A38F47A1C9416E72B5A6A47F747CDAA35A4863F2D0F84F36D6013B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468188, "uuid": "e9878d10-b805-4137-974b-293fa43c307a", "value": "49152:scf9j9dk/rAbPzmJbhRW9TrZksHyytLf4nCPlr/N:scjdkkjSJbho9TF5Pp/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468188, "uuid": "bcc1b8f3-6ebb-474f-b49b-9ff12fa4a3e8", "value": 1668100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468188, "uuid": "1aaa35a2-f8db-4cba-9456-fa66fb388503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468188, "uuid": "ec58704e-e0a7-44c2-8a57-0c71a78d5cc0", "value": "bizy.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c7fc39-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540128, "uuid": "05a43ab7-aed7-4294-8f0a-f8779a897b85", "comment": "Malware payload (Mirai)", "value": "69fd8ee2edc1ba60453d0561e3c1fc40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540128, "uuid": "3f34134b-19f0-4bfb-b71c-094a9cd78285", "comment": "Malware payload (Mirai)", "value": "1e43c5ac8cb31bb22bbd44a5d6b49ead21c7b2ea7e2a826a5ba5a36bc4e71131", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540128, "uuid": "c728b7d8-89db-4af4-9552-4792c8060a02", "comment": "Malware payload (Mirai)", "value": "7355946baf60623294f317ac6644153af492e133", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540128, "uuid": "66423bd4-5afc-4fc2-9fb3-fda1dd860706", "comment": "Malware payload (Mirai)", "value": "d3e5dc72f5a13280a3240ba94d4c5a294a5cd432b1b2f94b51dca532f6b9559f9b10bda4229b23e7a064d47e2d633bfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540128, "uuid": "55c39a61-d635-4d68-ac48-8a13b7e4294b", "value": "T162A2E1217F1DE98FCD37B23886E5E5C652D07D60D2ECC9865781C11FBBA36846834E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540128, "uuid": "325dfd25-bd6d-469f-a4ca-0c936df788ad", "value": "384:Mg/Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRt9nSyy:598o08kxofBE+ZkXaT47C2Epit9ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540128, "uuid": "781c541c-269d-4f52-a4de-b723feaa8319", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540128, "uuid": "24d36854-87a6-4316-94ac-bcb982e7d6c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540128, "uuid": "69deb1df-2792-4bd8-94ed-d8b455021a7d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed25bedb-cdf5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764511657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511657, "uuid": "59b3eca1-5510-4b92-bcca-9d10688d1c0c", "comment": "Malware payload", "value": "8a7ee4fe381edff119584127361d2c0c", "object_relation": "md5", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511657, "uuid": "f1d7addd-2f05-4808-abfb-5a0363b67f9d", "comment": "Malware payload", "value": "1f074a900898f19ea60d0e1fde62e11dad2cb02009810d5c5881c867476f6259", "object_relation": "sha256", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511657, "uuid": "e7313d37-c108-400a-97e8-264bb56aabc3", "comment": "Malware payload", "value": "ccde3ceca486999a20b03fb492d7f5ae932bf0c1", "object_relation": "sha1", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511657, "uuid": "6d204a62-8ac1-42eb-bdd3-5e7ae2ba62b0", "comment": "Malware payload", "value": "a3a5a35deafe035acc1d813d44744cad0d11f456c7f98a9c3b0084d283cf009bf23464f4e9b33d8fea483745fb7a97fa", "object_relation": "sha3-384", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511657, "uuid": "48f8d869-873f-40a7-9a89-362575fa259c", "value": "T1FCB29F07372A06E7E7488B79C0D25A07E8B8BB4147E65A8F9155D6382F093C13EF9E4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511657, "uuid": "987ce0d0-7cbf-4612-a93b-fbb728dd32ae", "value": "8f63c905f9c6cc53bd8bbdb0cfe4c90f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511657, "uuid": "70942e38-2efb-404c-a1cc-9134be17ea9f", "value": "384:TnPj5UgSxhQwl1oJJ8AkLcQF6ki2XWIi11XwbS+ShjmM6IGBkSn:JHSF1o8uH2Xa1RCS+ST6nkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764511657, "uuid": "f3197435-fd44-44f5-b2be-8b55ad3e6f4d", "value": 24248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764511657, "uuid": "36af1aab-4fdf-487c-9db5-36492a9b2539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511657, "uuid": "1a6e3fcf-b0e7-40c5-9bfd-b7db0ef82094", "value": "sxhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3701b35-cda9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764478999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478999, "uuid": "112eb067-7c48-4a68-9762-1da5fb821a9a", "comment": "Malware payload (Mirai)", "value": "5aef699eb859ad4b9ec4f71590923ded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478999, "uuid": "4e21bf9f-0dd7-45e8-a97d-f0e9f272a95d", "comment": "Malware payload (Mirai)", "value": "1fb2da6f4c65e1253efaee2da3bfa20e21ddb5094158a3e11074570445516bf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478999, "uuid": "f90219a6-9bce-4cac-90e3-d177b7bb1a09", "comment": "Malware payload (Mirai)", "value": "4b44325e131fc27af43fe3adab900fc0d8dec9ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764478999, "uuid": "090338d5-f8f3-4e10-b917-fcacb74a1a20", "comment": "Malware payload (Mirai)", "value": "c0752d91eb0471f6831badc753cdbd89e7582384e3bf61ac0f10049025998c2ba6b78662b0a1acc3f36d52cf12143aa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478999, "uuid": "ba7e9741-7ae0-4918-a05e-a422bbc5a427", "value": "T12CF32A02731C0947D2A36DF4363B27E093AFD56125F4FB44291F9B8A92B1E325586ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478999, "uuid": "cd8e0e83-6bf9-42e6-98d0-69971b7afe82", "value": "1536:iNyraICPg6i2Dl1KXri8zQfiEkGrTPGxV94Cj8BpqAVZLGDXU/FRcuwvTvArDiQu:XrcPPbHKbi8zTCnPGxwtXkDaRsEr43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764478999, "uuid": "54a7e32e-0d7b-42bc-bc72-2195a43e8b9d", "value": 166404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764478999, "uuid": "bfbafc87-5030-460c-8892-1804d712042c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764478999, "uuid": "ddc304d5-f092-4a4c-9f51-f2e15e1e57f4", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecb692c-cdd5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764497916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497916, "uuid": "cd5ddbe8-57f4-4cd4-b9f7-89b7fce46bc9", "comment": "Malware payload", "value": "717754fc040b71971d530d2f1e3783cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497916, "uuid": "ca7fe269-fc25-43b5-a455-1c1a92964d34", "comment": "Malware payload", "value": "2047c0fbbcae18a12ad7015617cd10aaaba2790dd5821cf926368869218fa4d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497916, "uuid": "1dcbe94b-9c6b-4755-88b8-29063cfc9f60", "comment": "Malware payload", "value": "6577222e84d94fdadaa7e20c1233c6c82b504816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497916, "uuid": "a07248d2-a1ca-46b2-9641-1b5862ffc34e", "comment": "Malware payload", "value": "7b317bb5607607d549cc6a7568d23079ce498bf0a390dfff5e5f92ce34fb1257b72e5b24e16d2d3531abf6b755e67e8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497916, "uuid": "9b755757-8829-4636-907f-ab20b5eacab1", "value": "T16373B60A6E758FADFB6C833547B78B25974873922BE4C641D16CE9005E6034EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497916, "uuid": "1aab21f8-c52b-4631-ac7a-daa184c5f77d", "value": "1536:I1jHIxYORkBGxYq5EDoG7D7/dKA6Z9FyvUPvlZPvvNgYUb6tbT4ug7Rkh:aoxlRp07dKA6Z9CmtP4ugGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764497916, "uuid": "335344da-7b2a-488c-b2c2-f73ac12bcb2a", "value": 80076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764497916, "uuid": "19bf52e2-0771-4848-bf4e-6aeb4254bb9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497916, "uuid": "570bd0d0-d1ee-471d-bc4e-53888cc71430", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f745db-cdf4-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1764510946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510946, "uuid": "2541b4ba-7128-4bc0-b220-87eb71780e40", "comment": "Malware payload (SVCStealer)", "value": "971d91c11dfda23eddb44690aedb97ae", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510946, "uuid": "8ce42ddd-a027-4e30-9d21-1466ddcef132", "comment": "Malware payload (SVCStealer)", "value": "207e0c77158970216870c9515d408d2437e4734b88bb6b2fe77326c99f1e0404", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510946, "uuid": "a1582fda-c708-4829-869f-02f2c01390e8", "comment": "Malware payload (SVCStealer)", "value": "fe17d51c9636333d5c9c9393d6b0a357e536ba19", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510946, "uuid": "557d9866-a5b6-47d8-a058-1cfd2a19f936", "comment": "Malware payload (SVCStealer)", "value": "c764321c68c7ff84cc1de10ef440a7ae28128a6421e4dcdf57535940b4fe0ad0db37115d6fc2a284da9f994880f3d8a8", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510946, "uuid": "da9afba0-0964-4670-8641-98dc394a33cc", "value": "T18D04BF4B63A530F9F1B78239C8518A59E773B4714661AF6F07E0429D1F236D18E2EF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510946, "uuid": "c2a6fa66-38fb-4b11-98ea-af439697549c", "value": "f35919722d8dcde279077a8460e70b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510946, "uuid": "cd13b640-f8c9-4e16-8243-cab8afd31237", "value": "3072:hmDL/HJ4uDmAFFgY0oJC6OTsEN8XeCggRMVUJ5uJrGVWurZgzUX8DwGZTGBV:k/HJtDBFHvCDon2VE0qVPMDJZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764510946, "uuid": "c77a9f36-8d34-4715-bf6f-220e268f771f", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764510946, "uuid": "e0a3e254-fbcc-4dd0-a290-bd743ae0fbf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510946, "uuid": "bc917c79-2db2-4565-bfb4-4a4e2a03cceb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399aaff4-ce40-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764543568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543568, "uuid": "35f0cbc1-1d9c-4434-a1fc-7b7ef8ba715b", "comment": "Malware payload (AsyncRAT)", "value": "1c781982c74602dd888debac790fb79a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543568, "uuid": "f209b391-8175-4904-8289-2a809bfc2493", "comment": "Malware payload (AsyncRAT)", "value": "20a7d1a78dca1e58e87070fd27cea08e8bb5b6b700ff0396e2eff620f010e7d5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543568, "uuid": "51f07a15-96c9-44fa-9190-182a0fe33fea", "comment": "Malware payload (AsyncRAT)", "value": "52ed5f87431f98513b10cb46e345e62f5e2dac97", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543568, "uuid": "a82b79bb-91c6-4f07-89a5-fba4f6d53c4e", "comment": "Malware payload (AsyncRAT)", "value": "26321674be94c1dc63194ca92037603c7631cd78ad4824e2df9a6ba0fa48c78c0a6e052f7d4664df93d3f11b3464a681", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543568, "uuid": "f6fae9c0-6340-401d-8a78-e90024b603b2", "value": "T166639D4CB7E00525E2FE9BB418B27322D77EE7028A13D75F58D900CA272B68CC552BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543568, "uuid": "20841f94-af1b-4c2c-93ed-b3a328b4dc13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543568, "uuid": "5b09ab82-c445-410c-8542-dab256ab7605", "value": "1536:0BidgrSqvIZjTH8WrRnbUbx3oQAYnn/e62ORtMf:snSqvIFz1bUbNoQJuORef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543568, "uuid": "7d9e74ee-79cd-4e75-b13c-255b95f6091a", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543568, "uuid": "f641dcd3-5826-4626-86d0-7d149a785911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543568, "uuid": "123148da-e402-46a6-936f-90196a590e88", "value": "XClient (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db1ec38-cdd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764499364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499364, "uuid": "91f61613-8a74-422d-83e3-2766bec6448b", "comment": "Malware payload (Mirai)", "value": "8a4c4afe3c1c4a455fd9a12d0e5771c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499364, "uuid": "569eee66-985f-4796-be0a-acbe182ac393", "comment": "Malware payload (Mirai)", "value": "2137071c83949263dc9bd17f7bc0f033ac92705b65ca5aa6c9b4af20289bbcaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499364, "uuid": "66853031-3bff-482a-ad52-951ab94a686e", "comment": "Malware payload (Mirai)", "value": "10c7ceaf3dc49373f158ea3e4563c92b47cdd556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499364, "uuid": "f803f615-c40b-4f36-8d78-72064fd8e932", "comment": "Malware payload (Mirai)", "value": "23664de22d5aa06be6ccd75b9f25cd568b952732e7d93b6aca3b6e7395da0762b08aa08f810635f0460e145a68c6505e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499364, "uuid": "ad124cea-6e86-4cd4-953e-290b3b4afc71", "value": "T1D0B31855FD819B52C6C2167BFB9E828C372713ACD3EE7203AE159F21338B45A0E3A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499364, "uuid": "b0cc10a5-4645-4250-8d22-711d7f325806", "value": "1536:rQVfWRrp6n7WnW0XtAp2i35oFaMkb882mWfyIYfklyNoeoOHufgPjkdvWBdhO/tt:LRQKnNXOIIP9epYfkgouwiOlEx09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764499364, "uuid": "7508eee2-d773-4301-b08d-56bef55c097c", "value": 116384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764499364, "uuid": "14e4b0cd-7a96-4a77-a67d-98a335733cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499364, "uuid": "c133acb0-0a88-45fb-b7a8-be9eeaca04ad", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382f7f6a-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540130, "uuid": "6b65ca82-155e-4ece-9094-3a88225889b0", "comment": "Malware payload (Mirai)", "value": "95595afc3b103031da5fc9789a07ed61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540130, "uuid": "530edefc-ca41-4d2a-b51c-a907f0577c5c", "comment": "Malware payload (Mirai)", "value": "226fc2d4b6f6fd4e8d2919c6a66d3b5031b8fdedd6386bf9f4344932d8347037", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540130, "uuid": "65e234ba-e357-4434-b22c-ece1c93c7579", "comment": "Malware payload (Mirai)", "value": "660a720b50ab34af1778c4ba9afbae8a59d48f8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540130, "uuid": "8b9fb558-173c-47af-8681-4fa707b4a901", "comment": "Malware payload (Mirai)", "value": "cc3d74aadec6f6e20ee153950806552d2a83ababdd794ed0488c2144d2b07b41b26574b1ade31601f97349be6a932594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540130, "uuid": "da5b2db2-1bd3-4c89-9d5b-b5802c65a075", "value": "T1E6837D01B70C0953D6630EB4393F17E5D3DF9A9022F4D549390EA78E91B1E32A586EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540130, "uuid": "ce3c3fee-99b6-4abe-8d85-a3734171ddca", "value": "1536:MGWQSAXFAVSU3CF1PE0bUGaqSGp0IilWYg90cOnY+Zn+SSAGA:MCNk5+EiuK0IoF1cO/Zn+X7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540130, "uuid": "5f0c13f2-3b5b-4b8a-8761-6885448916d6", "value": 83492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540130, "uuid": "67f246b2-38ad-4f83-b7b6-444dbb67523c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540130, "uuid": "6ca99305-a4f9-4e85-a042-4441a22e9e1b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab67d8c5-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468168, "uuid": "a1e566c1-b93e-4648-b5df-56c369a0ac18", "comment": "Malware payload (Mirai)", "value": "f6827fc2f0191a91f81eeb503cf273b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468168, "uuid": "217eaf9a-5c4b-4f42-b2cf-feb233c9fec9", "comment": "Malware payload (Mirai)", "value": "23699b08a3a0ec5228028064a2ee8efc12e9f90102a07b858116df90241624a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468168, "uuid": "175bc0dc-023e-482d-9a8e-f398c9d1c251", "comment": "Malware payload (Mirai)", "value": "0e96f1243d88f5e898f5a6752dfb1afaf2e4b1bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468168, "uuid": "174c9f5e-df1c-4157-ab7e-77d10f2d6f5d", "comment": "Malware payload (Mirai)", "value": "60b48f85e395fb6b1de522043a25a64164b756455babffd289d339ff079104a4963bd948a530d765200442370c911432", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468168, "uuid": "7a70e0ea-d4ec-4c41-a761-d9ac953c84f7", "value": "T10DC30A45FC414B23C6D212B7FB9E428D3B2A57D8D3EF720399215F60379695B0E3AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468168, "uuid": "528ea9ee-a327-4366-bff6-3479b741fa82", "value": "1536:AKZbPCG5NNaUEtwHD4FcJbWzAF+t/4Vczk7cdPWq5sWu1nd5m7lHpwwywdR1obTm:AKZbz6BQDecFWzZ4WkaPWqSh1dM7+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468168, "uuid": "78f39f0e-2d80-4ff3-be3e-d1583f961d6e", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468168, "uuid": "5867c45d-735e-4a64-ac4c-ef00c4307ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468168, "uuid": "1b68fc62-e86c-4941-bb51-14b22f99eec6", "value": "odin.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd437b18-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468225, "uuid": "757fcd83-ab16-477b-967c-48eeedecd586", "comment": "Malware payload", "value": "9193254c2f711986a1e339ebff94e7c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468225, "uuid": "8ed30dd1-81d2-49c5-94a5-273b9e87af6e", "comment": "Malware payload", "value": "237097489a17caf56bb0153fff0b0e9266c0ba31a5179b1aa30b976eb9d65e90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468225, "uuid": "fcc00f6d-6601-4262-b1ee-aed403a93bb2", "comment": "Malware payload", "value": "4bed3e83f3cc2dcbbfd063a9785bafd036a188c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468225, "uuid": "2d9d8921-9586-4007-a692-055d1f132657", "comment": "Malware payload", "value": "1aec62c28f168f7819c854fcf07d3b35b577f3e376bdce40fefb5d6373d7635ce64303a3769d1cf5ac690f5efe0e6e28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468225, "uuid": "1d3754dc-ab4c-415a-9507-42290cee4656", "value": "T1C1066C55FC1D6463D6C9B7392F3212983639BC485F81C7272B18BB3CAAF23588F52661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468225, "uuid": "4bdbcfbf-9b54-46af-887f-076b1d322743", "value": "24576:ayKANeaRKmc4LOxFPxrVOH+eR6G++pGvd/8oBfqsW5+VZkRM7rP+jlal1lkklP8B:arAwWcpIsG+DBiL5+LiNatBlP8b5Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468225, "uuid": "0643c350-89eb-443f-ab24-476da073c281", "value": 3801272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468225, "uuid": "aa07ed87-7a89-45de-a45c-bf847558a1fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468225, "uuid": "f9b09543-c3f2-403e-8ad2-6d345b4413b6", "value": "bizy.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970bf59b-cdea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764506788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506788, "uuid": "58733dfa-ef7c-486d-b2ca-2b0df5b929f9", "comment": "Malware payload", "value": "c5dc4d84e6c757db6d809e357c21481b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "super spreader", "colour": "#AA44C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506788, "uuid": "1cc595b0-6dfe-4926-a7f7-be9da071d220", "comment": "Malware payload", "value": "2390840a85bda956a3fef662d69d4070ae899b3c8bcc9f296ee5d049079c5b2b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "super spreader", "colour": "#AA44C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506788, "uuid": "4ca513e8-8844-43d8-aa8f-b3f8f5a0b018", "comment": "Malware payload", "value": "b215eb26c4481df9775e69d36ba9f50fa7bbb76b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "super spreader", "colour": "#AA44C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506788, "uuid": "4b915323-7e52-43b3-a02d-161285d72ed2", "comment": "Malware payload", "value": "be9840ea615206a82790d5003e791d41e403ab5e530c0923ec80cfd144288be4f67aef63e63f5cfe2faf930e3d0a17ef", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "super spreader", "colour": "#AA44C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506788, "uuid": "ac9e9305-b9f7-49db-a29e-549ee6a322a1", "value": "T18E42C91B675AD43648A693B3CC1BC9D1FF34928C2101448B32DCD1E6E71E5AED36AF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506788, "uuid": "a771a064-3b85-47e1-a4eb-3d2b6dbb4501", "value": "384:dSzHffcdP5kAyCpiOCzQ8gA6VguA6VguFolRdBFolRn+Fals6:dSzHffAiLz/X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764506788, "uuid": "529aa911-e567-45f8-9d7d-fda23308a24a", "value": 12834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764506788, "uuid": "bdea7fcf-07d7-422f-91a5-6ec6b48557f7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506788, "uuid": "e6a33885-e58e-4b59-a919-96187f976cf2", "value": "DO NOT OPEN.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bbe625-ce46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764546057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546057, "uuid": "dc4c873c-d81f-45f1-81fe-e535fef5819f", "comment": "Malware payload (Mirai)", "value": "9d4e1fd838c90d7c7b8e33d634e83d98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546057, "uuid": "ae56cd4d-89e2-40d4-9da8-bfbac02ad32f", "comment": "Malware payload (Mirai)", "value": "23be2c38161c2b23ff0316116a28cd3ab8977fbff0a1294a7f4e062c280e3e4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546057, "uuid": "731e98fc-e8e0-40de-bdf6-b26470f40be9", "comment": "Malware payload (Mirai)", "value": "feb0144fa71e96a9b2ab92799b99e400eb7cdc4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546057, "uuid": "a64f3d96-d8f8-482a-b53c-fa3a8f685ebe", "comment": "Malware payload (Mirai)", "value": "721fd66fba8197e250959dfe568c64b3115088181d91ad150e7bfc998a12a608facad64d941cb652320fef6a21774d75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546057, "uuid": "b49422d1-f1f0-4bdd-a8a5-4c34e6dc5050", "value": "T12123F177215AE7B5D228903F67AA55CA10B6A7F25BD73D364B1088ECA1C0D0D23B4729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546057, "uuid": "1abb101d-26f7-46cd-9ad1-52fdc6013cf6", "value": "768:Ax/APzP2GoqbMPVvJKY6xecRNVCsxI4zeg4E2K74VWPfEj920GKp2990FyPWrEOc:RnoTBJKY6xeTsWWeO2KcVWPfEwcwL0od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764546057, "uuid": "8e4d56fa-ba78-4245-8f90-7fbc68ec7c80", "value": 47372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764546057, "uuid": "40a8aa70-cb6a-4ad2-93e0-217d59829793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546057, "uuid": "acb5d843-0931-4492-ad12-7ad0cc17ee8c", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f259301a-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490621, "uuid": "b14263b5-f369-4e5e-a1ce-f152a404e2b8", "comment": "Malware payload", "value": "adfe8cfd063f4dc548e9a25a35a2457b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490621, "uuid": "19dcd73c-1524-4857-9cbe-670350ea92d9", "comment": "Malware payload", "value": "260ac08451aa3cfe04fab1bbc15ac04ab169cf051e43cd638e541409c3001bce", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490621, "uuid": "ab836e31-f8ae-4390-8c95-116acbb363f3", "comment": "Malware payload", "value": "952b32878e2ac2b3dc0915f87171508563348cec", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490621, "uuid": "fa73daec-5ac5-496b-803c-e703f7f2f287", "comment": "Malware payload", "value": "aa16c9085214d7aa71a8ad7d1e4915d8455b6564ce80304a649f7e64071d20d2bba8e40f56074cfea8594ac431d00f9a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490621, "uuid": "78ada856-5cac-4a52-ab79-e62dae4ff091", "value": "T12ED7BE07E6568E32C8AE933D58B687517B312D45AB4793572018F2BCBDB32D06F893C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490621, "uuid": "a35314aa-3d5f-4114-a4d7-1b42c0b8213e", "value": "786432:CdjHdDhl1CpvjUhZ0+22Ld+rUadVvhx1j3TtPVFv65swf0mBRcF0J:CfDA1UhZNd+pFv65swf0Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490621, "uuid": "5391678d-a9a3-4bf2-a392-45bc5340f6b8", "value": 61439370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490621, "uuid": "fefb4d86-bc03-46f9-ad6a-04aa6c931a76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490621, "uuid": "6ef01c06-ba17-45f5-bcdb-e1ed590b45d9", "value": "Web-Video-Cast-v5.12.8-MOD-OTR-(Getmodsapk.com).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad970fe-cdc5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764490662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490662, "uuid": "48022164-637e-436f-bc80-56a2beda277e", "comment": "Malware payload (Mirai)", "value": "7f17dc91e4dd8b7fe2f10481ddcee4cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490662, "uuid": "32fee854-fbd9-4f92-91ab-b7025214a31c", "comment": "Malware payload (Mirai)", "value": "26747feb143de8c556faed21d0578f6b523be58e8882c4247f1b506334c1d829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490662, "uuid": "bfa12d6b-ff51-42be-95b7-72b06ba4ce86", "comment": "Malware payload (Mirai)", "value": "ba8c026dd0cd6d2f608156146bdc277da7499307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490662, "uuid": "f8acc75b-2d1d-4e90-8ab8-050086f6f6c8", "comment": "Malware payload (Mirai)", "value": "8e737dd4e9e60ba80a48e5f058e293a0467e74d7a199948abcb01d8d77a7bc63b41cdda10926ec9fcf700f51ce1c621d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490662, "uuid": "62171287-9dd3-4e6a-bbcf-83486d841681", "value": "T18323078178819A13C9E823BBF66E41DD33252398E2DF7307DD226F51778682F0DA7652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490662, "uuid": "4d84f9ad-3601-4501-84b5-79f38874dc7a", "value": "768:PzKd0eNUrF+LNskLAI5N2lNUCG0UN/u+7O/Ml6/NORo1wAho:7KdM5+BskRN2lN+N/ibr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490662, "uuid": "6dca0156-2450-448e-a4ff-8fc274f248d6", "value": 47992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490662, "uuid": "4e7199a6-a7e6-4b6f-94cd-bc57b2f2fd40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490662, "uuid": "f65cb1a4-a53a-4a36-aeaa-97fd245280a7", "value": ".SarmUNO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2749a2-ce26-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764532485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532485, "uuid": "2a7e23e9-cbbe-444c-87c6-d941b98cc57e", "comment": "Malware payload", "value": "8230783a7d820b535cca1b5c1bef9e3e", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532485, "uuid": "b96f6e3c-d79e-47c0-9236-8f4e757e582e", "comment": "Malware payload", "value": "280e75f791c26cebb3e92bb8e5fb840faafc4a48454b7435d335f698715ba253", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532485, "uuid": "5be224e5-0986-4ec3-9c9c-79027572d5f7", "comment": "Malware payload", "value": "e75b331dcd75feb5b2f3fab986e0743dcb6ef1f1", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532485, "uuid": "dfd14275-331c-4a4e-8a56-a80de93a5c87", "comment": "Malware payload", "value": "de0026579cfc1f4610a7c46495928765eaf95a121a247e4911584ab39ff8862d91b5787b28c4149b37de6abfd2bf5c43", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532485, "uuid": "d8f42e3d-0695-452b-9eb0-49243898f85b", "value": "T15847330AA311CC38EAD4D1F7AA3762CE3DBDC8F24D25944143AB16F9C56F6D66833852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532485, "uuid": "67725551-d710-453c-9361-b47656ed7f74", "value": "5e48fbae3520a62c95e412b293e1759c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532485, "uuid": "c514bbec-dc43-40d4-baab-d1ae0d5a8b89", "value": "393216:ACUGiLe8Tx7eSguwQf675H1ulVc70tx+cR3WpN7HGzVWAsdtR5u7Uo8uf8:FUTL7Q8lVj+cR3MJHmWhtLo98uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532485, "uuid": "ab22ef60-53ba-41d4-af7d-8f4441ee1d82", "value": 25104152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532485, "uuid": "9ae171cd-0494-44ed-9334-99fbbc46083b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532485, "uuid": "4e48a23a-8813-4c2b-b673-8c16c91b261a", "value": "\u5b89\u88c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf81ad2-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468170, "uuid": "39c0d0a2-713b-451b-ad3e-6a1aae164986", "comment": "Malware payload (Mirai)", "value": "93e08acfd228e8ad126dc1384090cbc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468170, "uuid": "d8635753-caa7-4cb9-95d3-05ed76aef670", "comment": "Malware payload (Mirai)", "value": "28d1f0ec378ee8de8fb6a2c4b7513d01b551990bd072f62cd381c38bb5d0a5b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468170, "uuid": "eb6c2752-efc5-414a-a961-2d9a84c9576a", "comment": "Malware payload (Mirai)", "value": "2d39c89a9afa5bf29d687975513db2b8eb7bb190", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468170, "uuid": "19b70da2-7547-4be4-8482-b6be2ee14661", "comment": "Malware payload (Mirai)", "value": "fa04191e95eab01d17b3c434af8235bc2069c7d7242471b1fd263996e5cca6b23582b2b09200c88863214317f9747ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468170, "uuid": "fee5c785-5a5c-4415-9129-e9de0b1ad96e", "value": "T1F7042A45EA404B13C0D627B9F6DF424633239B9497EB73069528AFB43F8679E4F23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468170, "uuid": "f441547a-6b41-47a1-9b14-320f7bb12814", "value": "3072:7IeEn1EQ9nhgDxDCS0aeAdSc87RlgWfLoU3rJnowM/Rzu52:0eEnWQfgDlf0aeAdSc8FhLoU31owM/RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468170, "uuid": "063f65ec-c9af-468b-88cd-e9fa446fd021", "value": 176104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468170, "uuid": "21f66249-5afd-4f9e-92c4-0a86048d4dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468170, "uuid": "e72aa54f-7ba3-403e-aff4-6e37a5fd98cc", "value": "odin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6833891b-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468055, "uuid": "dfe929b7-946b-4a50-9748-f886e69fda86", "comment": "Malware payload (Mirai)", "value": "0964c061c69439126b8ab24a76da384e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468055, "uuid": "e07f9952-f145-4933-8941-f3fc28307a1f", "comment": "Malware payload (Mirai)", "value": "29c5fdc7b454c6b38753c8680729a695f27795bf9031c0de443b613753b96ee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468055, "uuid": "48f0a77e-2e5a-40d2-8c04-6dbee31b50aa", "comment": "Malware payload (Mirai)", "value": "84db7ea3bd09fac2b878497ff2a353676963ae84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468055, "uuid": "2bee91cc-7f4d-4452-aca2-4c8b34c2894b", "comment": "Malware payload (Mirai)", "value": "991ec67aff0ae178be621e28695e73f22c7dac059a1e72baa1a804bf47d0f1f4f68278a06d9e9be5b5750492e9454b69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468055, "uuid": "f1603b3e-578c-41fc-9c28-8c0012086b42", "value": "T1B5F3BF97B747A050C8E10AF41BCB5BAD393721018EAB89E77D2D723969779CB180B3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468055, "uuid": "51811801-b7cb-4a68-8d83-e25021e86478", "value": "3072:ilsDfjYiJFhUr3kuo6g0t2Mh7KtNvrdql4ugaCkTFUxhcdfq:5DfjYiJF67xg0bh7+B0KSCkTFUxCfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468055, "uuid": "8ff75a4a-1f08-4ddf-af21-29aa5f4678e9", "value": 157328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468055, "uuid": "3a64dbf2-37cc-4e13-b520-7e6c4d26b817", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468055, "uuid": "93c75f53-0327-4d59-ae8a-1e11329b55a5", "value": "irannet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4de399-cdf1-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764509725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509725, "uuid": "8bdc9128-c907-48ca-ae16-a1669f0b6861", "comment": "Malware payload (Vidar)", "value": "41017164fd1b3a4f8476c9d7669af46a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luxurycheats-live", "colour": "#DC1CF4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509725, "uuid": "4bba368e-cdbb-4a2b-8a70-15ea2a749fcc", "comment": "Malware payload (Vidar)", "value": "2b8dbdb7316954190047baecf8851330b0bcb7182e6c7938a16163034ea247f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luxurycheats-live", "colour": "#DC1CF4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509725, "uuid": "0300b0f0-5754-4d9f-ac98-585a1a23d7dd", "comment": "Malware payload (Vidar)", "value": "a31546e5396943cbbb888747e2e3ea47f0235646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luxurycheats-live", "colour": "#DC1CF4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509725, "uuid": "0a5da349-c96c-4cc1-a543-bd63bdf6d401", "comment": "Malware payload (Vidar)", "value": "c889ee16febee5d911fa7311a5b12d1301bc0b21be27a6636ce4408ad346f2e54263c3479625e0655287be66ea2bf964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luxurycheats-live", "colour": "#DC1CF4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509725, "uuid": "dbf2401f-8e52-4eb1-9a73-e408eb22ab85", "value": "T19EE623D75AC572E4D08A8E30D2BA0F9970D2BED941AA6F1D37CA7D063670F47C24A523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509725, "uuid": "447c13c6-1359-4eaa-b10c-5b65dafdca90", "value": "da0173a5eb427af15dad82d5fe30ecca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509725, "uuid": "06a432ff-f558-4b79-aefd-3d36a5bbe6a8", "value": "196608:BSE9Q1tCMefbHL56uCYUJG2+UidSDMy66TL3/igMrMnMMNmwLVwKPsjAxp7pzxMi:k1tv8bEuCYrE/6E/fMB8J+KUjA7FxIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764509725, "uuid": "a8172e43-3696-4f23-a30c-60de277b25d7", "value": 14961152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764509725, "uuid": "406f8d92-6ec0-42bf-97b6-f2b219cce0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509725, "uuid": "bcb48c3d-668f-46cc-9995-93df84b31845", "value": "LuxuryLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985f70d5-ce17-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764526118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764526118, "uuid": "176ae798-3df8-4aae-9329-3dd994e0ef3c", "comment": "Malware payload", "value": "12b5f699b5bcb042afea09f269e9970d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764526118, "uuid": "89d37e5b-c91b-4cd4-8bd3-3a1734723ab1", "comment": "Malware payload", "value": "2c79e2a9808b723c68fb423503f8982078c0f529391cb6f36028ca2eb625c0ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764526118, "uuid": "387df10a-876b-4a61-b6a4-33217c429997", "comment": "Malware payload", "value": "3742ddd91091fcb73fbdf6b626a72cc3ddd71466", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764526118, "uuid": "cb15f324-bb9d-4790-b109-ce0135e46c3e", "comment": "Malware payload", "value": "037973f67b7e0d79094912aa929ef711296241e03aecacbf7b3b3c95f2a57ed9a1ffba425abd509e32864c31efa10e2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764526118, "uuid": "28f157af-7efe-45f0-bc35-8fe54a042852", "value": "T17B4302139E43C120D5D3C1BA3789CA12C15A395E764122E0267D4C8EC92EE52E7FFBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764526118, "uuid": "47cb9fa8-c19e-4283-82ba-997f85a6c6ce", "value": "1536:jew3F1L2L72dlLoiYVqgo0WC/MdJYQxygvDoTWOeEt9:T3F1KPqlcLtT9/MdJYQx8W09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764526118, "uuid": "ceb19ef3-7c85-4d8a-a6f6-9aa66ad6d278", "value": 56760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764526118, "uuid": "9a7ad81c-363b-4e9e-844a-82605c9ad83a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764526118, "uuid": "42117efa-e617-4968-a5bf-5b0d854c7c31", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbe7a48-ce39-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764540545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540545, "uuid": "0e564675-9366-4d29-ae1e-6ab7c47d7e5b", "comment": "Malware payload", "value": "1bd31696a1fe4563324adaad6bbd615b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540545, "uuid": "1a8cc4c6-a175-44d1-8a6e-6f763c53380d", "comment": "Malware payload", "value": "2d8e8c96852d40faa64b888c20579c5a169285a5710857448e711a7e376a29ae", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540545, "uuid": "fb815a43-e4b3-4a3e-8725-23a5c2f57591", "comment": "Malware payload", "value": "45fd97bff239356ec493abd07999b5fcd745bc5f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540545, "uuid": "d83b5089-e7c5-4ffa-8abe-1e821779bae8", "comment": "Malware payload", "value": "734a97d9293546f0a19a85315894b08f4b4a18c6ab281131ab6a238fd442fa9e82b2befa99ee79ae88a3a977d575779c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540545, "uuid": "41fcab0e-38cd-4bd0-80e4-9f0a985accac", "value": "T1729533E6BBD49462DEF03F3008FF86930E7A3C724831536B3695218A4DF2695A535B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540545, "uuid": "3711e3fe-0ce3-4b5a-83b7-94912ac34943", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540545, "uuid": "1e7e64d0-6707-482f-933d-8f5c9cbd1d9e", "value": "49152:pqUSXd7eakaizjdMMz18XJ/MrNFlPJvZTGrA:pjaU8XJ/MBFlxorA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540545, "uuid": "2b9ab569-f465-49c2-961e-42a941271a2d", "value": 2041224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540545, "uuid": "04bc159b-5c7a-4de6-957e-49bc36115906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540545, "uuid": "986dd108-b0ec-4fe6-a991-876b3cff40cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7544b81c-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540232, "uuid": "68e7873f-c16d-498a-b24e-f98c194bdecf", "comment": "Malware payload (Mirai)", "value": "cfc340cd2359a5291f5a8bfe1bc9fde1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540232, "uuid": "09affed6-33d7-4d61-8fe0-585e2b18016e", "comment": "Malware payload (Mirai)", "value": "2f6758a3f29a73ee7803769fb19ca7acd57d31ccdbcadc1881abda6bb55d12cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540232, "uuid": "5fd5cc3a-0fa0-49a7-954e-71be25020a1a", "comment": "Malware payload (Mirai)", "value": "77d550747f4ddcae328b4164f5dd5fd76101169b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540232, "uuid": "67d3d075-a39d-4fca-b9b8-484a86c2d094", "comment": "Malware payload (Mirai)", "value": "1d58e7aeec0e951b553dc1fc97cea36e3e88c6efe3f4dc5982010a4ae90d81b08f01ac265f732b4f4d7ee893b774aacb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540232, "uuid": "f0af2e75-46bb-4bd9-93de-864c7aee1977", "value": "T1CC73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540232, "uuid": "8ad1eb96-76bc-4486-85e7-68288c729560", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStQ:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540232, "uuid": "04d33553-144c-45e6-841d-8624954f76fa", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540232, "uuid": "bc607780-145f-4014-b040-f099ae9f991b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540232, "uuid": "49bd27fb-5b81-4f6d-a3b3-25f9ce349da2", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b6fa3d-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764530700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530700, "uuid": "c0cd617f-3a83-4b22-adad-5e5826856400", "comment": "Malware payload (Mirai)", "value": "709fe6d66c9243907372beb3573721a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530700, "uuid": "4ac5e7cd-0f6d-4d42-8eb7-5fe562069b0e", "comment": "Malware payload (Mirai)", "value": "2f903cfd3fe60631ae21bc9212aacf8132c17525787b036dd4e1de692925ca85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530700, "uuid": "c3f1ab28-0fc9-4475-82a5-fb4ffa043796", "comment": "Malware payload (Mirai)", "value": "4f605d288ff9e975ccc058179a899d398e4b09c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530700, "uuid": "fbd7d8a2-b86e-41f3-8ded-fa52268eafdf", "comment": "Malware payload (Mirai)", "value": "7363cfe3277ff4977c1c1fc1534c8ea43bcb6dd1c27ca8d05ee67f742b9cc24255efff78c6f9aa28ab490aabb26afece", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530700, "uuid": "1593624a-47c7-4b97-8faf-7e4de8898a81", "value": "T117E31959FC809B11D4D635BAFA4F024933535B6CE3FEB112EE244B2127CAA1B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530700, "uuid": "63b459a4-7e30-4bac-b3e8-f88e59bebdb9", "value": "3072:PeOcv1AU9K1lOxhnQPH2hYptb+TPaKjvs82+23FrJeTip:j61AU9g//2hctbmPaKjvs8iSTip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530700, "uuid": "0d61c38c-72fc-4f90-857d-c4f9c4ee7674", "value": 145220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530700, "uuid": "73fd4e33-c469-4717-b274-65e70d299ab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530700, "uuid": "5e69a3f4-4724-4116-8994-bf8f8d3328a0", "value": "lava.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d738224-ce43-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764544863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544863, "uuid": "ab090c51-8871-4217-a070-39d241064452", "comment": "Malware payload", "value": "785013673f515982c5412b07e8e67262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544863, "uuid": "0672ccfb-5830-465d-b29a-7551a37cac5b", "comment": "Malware payload", "value": "304521bc33000d5cd75f7cb85d7318da92fd65b19cce43c5b3bdddfe5d02d67f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544863, "uuid": "503c4948-66c4-4c32-8c59-d4020fcd8db5", "comment": "Malware payload", "value": "15d65fa1e7c04229a6684afd8e44c45f05487532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544863, "uuid": "1f6f378a-2233-4348-9808-f8ce61a10a83", "comment": "Malware payload", "value": "0a62b1c321f6303e4e8b2d5474fe49c69ec40e71205954e35bc09b06051c5f90ef37bccc0a020619438b3264d9933a0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544863, "uuid": "a4fe122a-3348-4af6-aa5a-d00117da9931", "value": "T1A1432941BC929A22C6D4127BFA6F418D332663E8D1EF7207DD116F157B8A82F0DB7A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544863, "uuid": "ea8dfee3-8c4c-4716-b30f-92ec09d8878c", "value": "768:Bmnt2qcp1SZyD5uVpUaWxJZbIval4EeoxOA3oMAim2UKlU1NDujYJfOgNxS8htuP:Bi2Np5aWj1ealTeocicK0u0fiItu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544863, "uuid": "263e55c8-37c6-4318-805f-ed57696bf030", "value": 58236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544863, "uuid": "3c6736ed-265f-4b37-b685-61c970d8aa15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544863, "uuid": "3944d233-5b60-4654-8555-ce9d316a33d8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420c08b5-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540147, "uuid": "40619539-d73c-4c2e-8c53-56fe17d20979", "comment": "Malware payload (Mirai)", "value": "a58ac0b8818c457b70e9c41400c1b9c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540147, "uuid": "f20ae2c1-82d1-4335-b58c-9d4f1ac35609", "comment": "Malware payload (Mirai)", "value": "3094fec1b0e193664046d23fec3553492dd1f4141c3192279e138e381eab891b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540147, "uuid": "a3bd2a77-bddd-4ae0-b824-5f1570b35e95", "comment": "Malware payload (Mirai)", "value": "b4994364bb9e59f3a82996a341c4a1f8d2ae4bc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540147, "uuid": "0ba059ea-a3a0-4b88-8c91-54f8d0f10d29", "comment": "Malware payload (Mirai)", "value": "d1176c9e1b2ab40564943e1935517ac4b13c39813faf733ca05eac87ba6c61a6986e56b37531730585de715aa827bbcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540147, "uuid": "c417f652-d01a-478a-a18f-537615c79732", "value": "T1A773A61E7E228FBDF759823147B75E21A75823C637E1D645E26CD6002E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540147, "uuid": "f235ecad-8d10-4d96-b50a-3eb2964fff20", "value": "768:JNRSmI7Lsj0KwwRZTBXkrY0N5lbhnJLfszO3o7STP3MX8zXQA4wMi3RAyZzFeI2p:Se0pQ0rn3P3MszXE0te7EQW4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540147, "uuid": "bc06ad41-70a0-4029-8713-f1692cffd243", "value": 80680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540147, "uuid": "00ac47d3-f5e6-4964-ad24-56874c820f10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540147, "uuid": "bb3000e6-95af-4082-9c97-b106ab2cff6d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f4c08d-cdae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764481119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481119, "uuid": "12fb61b0-e3f5-4540-a3b3-6380bece2606", "comment": "Malware payload (Mirai)", "value": "007de69939358b805013539f9faa491d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481119, "uuid": "00cb3788-a357-42a5-8fde-9dae34ea6ef9", "comment": "Malware payload (Mirai)", "value": "31137979c56c7f6066aa04e0d32b5483149b24dee5f353a226a81b08dafbb0ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481119, "uuid": "0d1cabf0-a5b7-4f96-acb4-641180b71ed8", "comment": "Malware payload (Mirai)", "value": "6f23c27c3ff306a11d431bc751582723bc2ea11d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481119, "uuid": "71ce6d24-964a-4993-b02c-a71c5431b608", "comment": "Malware payload (Mirai)", "value": "2186fa16fc9fb2a44d8726dd7decd1bc6c26ee75d02f8ce70fc4fcf745953e0ee312f0aa5c0701f534f6a0de3d98a1e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481119, "uuid": "c12d94d0-c33e-4198-8234-0d645fee2b15", "value": "T110530941BC918A17C6D462BBFA6E42CD332663A8E1DF7203DD116F157B8A82F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481119, "uuid": "d6a78bde-a337-46ca-9878-c3ada73e6f98", "value": "768:G2PsVboSXnxVTsYujP2oVub5f/Sc+Ej1iURm/DhUst51NQ87Izcln8lb8Ktug7R:XsdoWujbUVfqc+E4jDLt+8WcyPtug7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764481119, "uuid": "35f692c8-9ca7-4013-9978-dd989b313896", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764481119, "uuid": "0c717a1c-f43a-4665-b711-e56b5bdc3038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481119, "uuid": "2755c31e-c188-4ebf-9497-d75d2ec52426", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8764b3-ce41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544135, "uuid": "969496d7-f440-4743-85e7-996d26021387", "comment": "Malware payload (Mirai)", "value": "d5d323325ab21c6982b068db93ce2da7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544135, "uuid": "0a695a02-c377-469a-9272-3a2019290b83", "comment": "Malware payload (Mirai)", "value": "31e37c81b171e470b5b41f8ad8408b5d2288fed0a70615e928c8d20c505f9eee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544135, "uuid": "e327f297-c2a8-4a3c-becd-082292219330", "comment": "Malware payload (Mirai)", "value": "71abbf91e54fa43206c6d4db0257be7d2e2bfa86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544135, "uuid": "22d0f84f-0e02-4ee4-92b7-68d6284fc1a1", "comment": "Malware payload (Mirai)", "value": "4d6704b62e78ca376b0bfa8a36e25817ec11bdbdb7b115855149cbf4f3928c637eafa2acb13203df76f91fe6ebabbaef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544135, "uuid": "637d0121-79ff-4d39-a398-90f334283508", "value": "T134D34A22753A1E2BC4D0987E22F74761F1F157DA26A8C90E7EB20D4FFF252206547AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544135, "uuid": "ad69cf48-7538-4f41-af9a-580c4b2b8c7f", "value": "3072:ifWnG9Fz2+Zkz7RDwizg/9m5M30aW91ls73jN0:gWnG9FjZMRDw/makm7TN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544135, "uuid": "ce53ee94-7ef9-4bcd-8d17-44f8d1b33cb2", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544135, "uuid": "1e1f1cbc-2a05-4887-9c40-5262f2b551e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544135, "uuid": "ec55bcb8-c711-4fe5-916b-3c99d856c17e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccec69bb-cde8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764506020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506020, "uuid": "87876ae7-d6f0-417c-a9e8-b7d2dfc2d996", "comment": "Malware payload", "value": "9a4970cf9af1e0d83063c43030b3d2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506020, "uuid": "c3f2bc98-18e4-4c10-b207-8c2ef0d7e242", "comment": "Malware payload", "value": "33c86ecfc324de3af97150bd009aba7925a6ba7a0842e127e94cf351013c0fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506020, "uuid": "d1a6cbff-6741-47ab-8933-c689993fb7aa", "comment": "Malware payload", "value": "e89c7096f1ff36d5674aa70ac82fc7797ffe9d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506020, "uuid": "2ffdb29e-f1cd-4d7b-bddb-efd4f5c5ff88", "comment": "Malware payload", "value": "39ac1bb7dcd87c5424a3ad8ba01f3f59751378f7ef970d62b6fb5219e48c6b15b5cea50e66ee1ab4c7e97908e5d7c6a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506020, "uuid": "0e95d36d-d01e-4815-a662-6a58a212fb96", "value": "T13308390E7EDA0602FA7916B43C7E0F9A0BA3E538F01557E3161EEB9CE8511D67E24193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506020, "uuid": "015823f1-08e9-4e96-ba37-574c24e07755", "value": "456c5f4eb288382b62351b047482c783", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506020, "uuid": "55176d5e-ea94-4bac-98da-9550ed5e6ee4", "value": "98304:vM8FuCYsdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdl:rFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764506020, "uuid": "e4b1599d-f427-4093-9bc1-b33e60ee41df", "value": 81717184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764506020, "uuid": "71bdbae4-38ce-4a2e-9221-c0c33fe9110f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506020, "uuid": "1b622879-522d-48d7-9ed7-95c7c0f7e98b", "value": "silke.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaec76eb-cdd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764497802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497802, "uuid": "ebfd5df7-d753-449d-aa2b-09d9b339fb02", "comment": "Malware payload (Mirai)", "value": "c827e2f146e4f829390298b40244954e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497802, "uuid": "1dd1bdcd-5fee-4e2d-890b-35f82ada45f3", "comment": "Malware payload (Mirai)", "value": "34a6139fb36eb1ee7f9e0b30555c595cc983c82f0d3604a1e0da5d6550ffc4c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497802, "uuid": "97c7eee0-654e-45ee-9830-22d0ceb7d6cc", "comment": "Malware payload (Mirai)", "value": "654414922d2224547e62010ec531937aebfdae66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497802, "uuid": "89631051-d886-4969-8fbf-6068c5709c66", "comment": "Malware payload (Mirai)", "value": "cee6c853169747d19538fe4b0fad0bca5b3ab3ab791bf856874ef5415823006e0accfe47c5e6a37b1b5969d80730f36f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497802, "uuid": "8cc0497d-a7bc-41fb-a516-e992cc2a9655", "value": "T1F1433BC4EA43DDF5EC09157964B3F7369671F4391018FA83EBA9EA32F842701A54A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497802, "uuid": "6ef5cd7a-506a-4316-896d-782cd2c1c2ac", "value": "1536:L9j0ijSVR4ZqqHHv8rJwKhyCVwCeMnbdZNCU1Z3yDrhR:L9jr+VSZnHUJwKhyzCeWdZNv15Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764497802, "uuid": "b0952df3-01dd-453d-853c-d35db29fc917", "value": 55956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764497802, "uuid": "73c88cf3-3bea-4ba3-8b2b-5265f70662e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497802, "uuid": "57358dc8-e608-4aec-9b04-21458b34ae6e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55c3041-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468185, "uuid": "3002a810-4802-4f79-b082-e3c604c8b0d6", "comment": "Malware payload", "value": "189ff404b475bf1b6eb395bc65e56aa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468185, "uuid": "5eb80cb8-96c5-4fb6-9bbe-0d4671e487ab", "comment": "Malware payload", "value": "34ec04f0ab17549a20bd7fb257497059e087cd64be342b483a72a2ca64ddd20c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468185, "uuid": "bd4ac20a-d4bb-4cc3-91b0-8a61664b0f25", "comment": "Malware payload", "value": "2462e0b5a833714ed489ea32bcb2c9343e35d8e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468185, "uuid": "08a095d0-95e6-446d-aefb-c23ea3a0031a", "comment": "Malware payload", "value": "9704860f77cdda229b029f047d289eb59f9b8b3853072796f1fca4730e720f7bd2f8a8bb2c3a68f09842f2af6db2070f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468185, "uuid": "54caf7e9-ca1e-4619-a36d-08367e478b5c", "value": "T1837533F92DC6A2DC4E731AA94FC547DC32C39726D8F43C62BA182DA405462A5B7B17CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468185, "uuid": "da4d8e55-4910-4cf2-acda-3b8c6836926f", "value": "24576:zit1JUGplKm21od3sLtK1UJbhifypi9yTddShMWLew34nMKRwoGwKBi3sfQs3paR:zUOGOmOCcLm8639UiKs5IMKCo76UlQaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468185, "uuid": "7cd47765-61f0-4d9c-b035-8468f61b5b2e", "value": 1626952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468185, "uuid": "a48ad562-db1c-465d-abd5-299cedbce0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468185, "uuid": "db551ced-1331-4d43-9682-147e610ca3d5", "value": "bizy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e4681a-ce48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764547018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547018, "uuid": "81373776-af07-477e-9c56-7ba319264f97", "comment": "Malware payload (Mirai)", "value": "6deff6ef103a556e90a3461fcb05f72d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547018, "uuid": "8baa854a-4d1a-4c57-b2b6-65410a15aedf", "comment": "Malware payload (Mirai)", "value": "35e60aaf864d2d55e035f5dff1dc688b8905d47fd4e61cb47f2630aa30cd4e4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547018, "uuid": "1dec3026-f3ed-4f57-aa8a-77c0f302f617", "comment": "Malware payload (Mirai)", "value": "174cb41eda5a0e9b41562a421af33d2625a2bf8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547018, "uuid": "4bd5182c-c169-42f4-ae23-b0d1fbbfd8ab", "comment": "Malware payload (Mirai)", "value": "5c51ad6b0f7f8210135f7f8a4b43094ee0c5d22b34ca13c6955d06892f229652d99f0421a68c30f82868f0d5745ce410", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547018, "uuid": "fde6c75d-42f3-4d2e-bf39-72ac8eadb15f", "value": "T1B413F111D1DC8FDCD45FC63D297F3A4A0F05A7E64E260BF112A4B0352052BAC66AD7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547018, "uuid": "f023cf54-2058-4870-add3-fcddfc412a46", "value": "768:wpf/8KshvtflEvvMYx/jXZTTRfLbt5RQc6xVIxJ2mKm4y9wFbmADQ2PjPR20Wu7Y:+/yFfKMs/jNTRfLbtX6M72ycbmADZjPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547018, "uuid": "a5c90eba-3232-4721-b9ce-2bc377e8eab8", "value": 45432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547018, "uuid": "78a964bc-188d-4f9b-a9ba-6bd3d8f83ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547018, "uuid": "95ed9f37-0226-49d1-b0b6-d418dd146fb1", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b1d33b-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540148, "uuid": "42950959-b519-4a71-ba09-0c86ddc67316", "comment": "Malware payload (Mirai)", "value": "1d9b9ffb262c036650814da2de2bf908", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540148, "uuid": "5c62a044-25b4-44a1-90c6-594f45c5ebb1", "comment": "Malware payload (Mirai)", "value": "3625c3d81624dc6e8bc45b8569bab9c11601d17f52cc0deac30cd15583026716", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540148, "uuid": "d253c908-c42e-4c31-b293-3c46e28eff64", "comment": "Malware payload (Mirai)", "value": "a642eeaf5642ab93f71da62217edbaab249dfe50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540148, "uuid": "dcb89bb7-34aa-44fa-8a4c-facc79d14ecf", "comment": "Malware payload (Mirai)", "value": "e71f6329d1afd9df132f201dede8139bd7825d7d74f3791ddb59a053e8c32538357257237f34ea64426d702c632a2d2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540148, "uuid": "992e8b15-0fa2-4246-9e85-1bea728546aa", "value": "T14CA3E90ABB614FFBD86FCD3745F8070235CC995222A93BB57574D61CB68B14B0AD38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540148, "uuid": "f9c6329d-0e88-4fa0-bf86-22f3b1e31107", "value": "1536:fb9Z/u4og+W7e3eQqbPFLSnlbpmFXJggT9c3JjWiERM3ZZg6cMdSxFKk0MSSyHi:fb9ZWwp7e3w7FcbpmCj0M3V0wlMXyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540148, "uuid": "1f785b11-144d-435c-8921-902a1b2980e0", "value": 106152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540148, "uuid": "8bc9c20d-620d-423a-aed2-fb87b73ea660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540148, "uuid": "5e92a39e-695a-49d2-856d-c583cc194af9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd01a27-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496730, "uuid": "256f4b45-fe04-4726-b1a3-9a74e62f1599", "comment": "Malware payload (Mirai)", "value": "b9706f1de6adf7e592001b7304bee53c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496730, "uuid": "bd6f04a8-4ad7-44c1-8a32-b17e893991a6", "comment": "Malware payload (Mirai)", "value": "3648de9ea826c454dfaa66e0fa4b4c66dc92f8f3007b9a8ad89d3afc28c9f0a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496730, "uuid": "885205f5-7b15-4902-83c5-c638bfa63de0", "comment": "Malware payload (Mirai)", "value": "039aaccf5fb23b7a13e2d7f89eebf25ecc89542c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496730, "uuid": "82a1c7cd-16f4-46b0-8e36-3f56360dac2a", "comment": "Malware payload (Mirai)", "value": "84ef6845548faee8654b1ef51ef97e27e06ebd5f58da8b74ff76a4e279b60a00f3d3f43574865ab9b7aa9073edd488f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496730, "uuid": "cd18547a-ae09-4d0c-8541-a811e730c4ee", "value": "T14C83F74ABD819B15C5D922BEFE1E018D33535778E3EE7213DE115F24278A92B0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496730, "uuid": "6ee45330-ed94-48b5-bd89-1ee6f933dec2", "value": "1536:65ni9+RUkxPpYDabwqy4bKpw9JOL5p3YA/QrdlebiQaCpH7ltug7R:vqUmKDabZy4bKpwXOL5p3YARKCpbltug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496730, "uuid": "ca8e5a05-b802-4d17-8da2-c014cd538dfd", "value": 85100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496730, "uuid": "09f16df6-39d2-4de0-9a98-22b5e33879fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496730, "uuid": "ed85c531-c0f7-4226-92d1-f675823294e0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e97080-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494244, "uuid": "10bc1961-5fb8-41b8-a914-5ca1a8ecff68", "comment": "Malware payload (Mirai)", "value": "93fb722723ef09b6e21405f157b4f55f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494244, "uuid": "de4f2a7b-e4b4-4c17-9906-8d7d978278fd", "comment": "Malware payload (Mirai)", "value": "36898eddab233ccae5030d01b753a2b52a0d45e732bab9b9f6f8adcd863948a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494244, "uuid": "8167f219-dd77-4fa5-8be9-85665235919b", "comment": "Malware payload (Mirai)", "value": "c14e4e073122e9d20a78a07339c8ba533fccd77a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494244, "uuid": "292ee32d-72a7-4bb4-8e4f-5af1f72f0818", "comment": "Malware payload (Mirai)", "value": "24f4621b4390a0ff15a5b94905ef80b35021bb06ffee53eb719fc6630c8ddfc736ffeac263a4a9e5e313d1f89011db9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494244, "uuid": "a100dd2e-a92b-4fe8-8846-19fc1a6d0449", "value": "T160C36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1A01D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494244, "uuid": "3dee37b4-c924-4c74-a8f4-e162d9d888b0", "value": "3072:7W2WA4KfsQDNSHjiz2FBOeF5Bts4ceGM5UQ30hAB1Ey:Zr4KEKcHmz2F4eMeOQ3Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494244, "uuid": "78540737-2c00-48d8-8700-bf09d9fc8faa", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494244, "uuid": "390ed1bf-5e5b-45f1-bcf5-9d63636d99ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494244, "uuid": "2e549098-670f-4989-ae96-4c91125869b7", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3abba8b-cda3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764476449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476449, "uuid": "0129eb1b-98ce-4910-afb5-c440b42dce2c", "comment": "Malware payload (Mirai)", "value": "ea5d88aa23ef5c6eaf1c36a63b00fac1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476449, "uuid": "57bd5e4c-eb6e-46eb-bc88-fc27e6af2124", "comment": "Malware payload (Mirai)", "value": "36935bfed193e45eb6b102c5aebb049ce571d3578d3b18951976dcf6c3991a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476449, "uuid": "15577894-62b0-4dee-8da1-74805b9e5c1d", "comment": "Malware payload (Mirai)", "value": "f0d0fdaadbd81ad64bcd0a170ecd14fb7cf9abeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476449, "uuid": "62b7ec7a-1a46-4408-9237-8febedc8f3d3", "comment": "Malware payload (Mirai)", "value": "8c7228e0e90eca8f0159200c2810f60d6af96b0173fb36fe70e849c482a16f0b3ab2e80a870e20f7425204432b511728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476449, "uuid": "bc95d67e-38b2-48e2-9c34-6a45a1b2823c", "value": "T1AE2480E2A41059DBCE1088BA73AC8F7427827C74C25B1F7D4D524168A28F9DFF1D6BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476449, "uuid": "2f83af29-318e-49a6-b74f-5efda1cfaed1", "value": "3072:3cp7A7VxW3wbukWIPnTJBohyeBiW+L1/+L4:3cRAv/WIPnTJmhBP+t+L4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764476449, "uuid": "be1066ab-ddbd-4c19-b123-3198e0ca29fa", "value": 219920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764476449, "uuid": "d4af167b-5c67-4061-b458-cdbc5d39483a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476449, "uuid": "2bf5e683-644b-42ef-9284-aba6c8221b68", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d728775-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468091, "uuid": "cdcb9334-6f58-486d-af1c-d7af4c025d18", "comment": "Malware payload (Mirai)", "value": "dbc99c68cfce2a87705e7865a3285098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468091, "uuid": "7951a574-fdd4-452e-847f-a19ca27585db", "comment": "Malware payload (Mirai)", "value": "37190d6810840b7941e3e5542a85a08f498cee64f94be797e6f76dec5f59a31b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468091, "uuid": "95414ebd-ea32-4e3c-b6b0-f87f5215b958", "comment": "Malware payload (Mirai)", "value": "bf37dee4584bd89b6841fb1f3d0ad5b5da04a589", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468091, "uuid": "55833989-a33a-4f03-8389-e6d661ea901b", "comment": "Malware payload (Mirai)", "value": "65ad9c539940ff48c4ddeb1aa55440d6e40743ad52edfe7e523993d49ef91134c8b67bce9d7dbe327ea3bd4d6769ab45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468091, "uuid": "e7fcc2b4-104a-4d46-bef4-3f63e729c2e9", "value": "T126246C69BA0F6C41F2C2D3F8DE8C87E13A1B35E3C7768971791212ECDAE39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468091, "uuid": "9702d72e-86b0-486c-96c3-ea3600e18e24", "value": "3072:k77gWZ2/uj1IgUzF3/hiv4TwcYR7tk3JP1xiAM4h9oq:kwWZ2/U1IgUzFPhq4Uc67t0FiAv9oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468091, "uuid": "1baaf60c-21be-486d-a48a-064c5b8baa9a", "value": 210928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468091, "uuid": "89c2338a-1ea5-47e6-954f-7888b193e6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468091, "uuid": "b1f2b30f-3096-4213-8a8b-927da8356f82", "value": "irannet.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5403b06d-ce41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544042, "uuid": "5b1a9173-4cb6-4ac4-a876-bc37a53446f7", "comment": "Malware payload (Mirai)", "value": "14b1e0ec77375c3043f74529c2327ae7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544042, "uuid": "f0ee8a73-a6f6-46e1-9c02-c0e5fd79b6a5", "comment": "Malware payload (Mirai)", "value": "373e1d501982dd2f9e1e8a2f531b3a6ce09b3a1294c0f671e773e073154618c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544042, "uuid": "df21d9f7-4b28-4814-af3b-e9216fb992cf", "comment": "Malware payload (Mirai)", "value": "76283bf44b164b4264b07423d10a462be9076b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544042, "uuid": "542bf553-d777-447e-8ef2-559fb568047c", "comment": "Malware payload (Mirai)", "value": "615bdcdfb139eddb971ca7d602633112d7624a1c4c0b945f0ff5a6b218fff24bfd066ddb41e0d1c112dd97d206b741f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544042, "uuid": "e0a512ee-e22a-478c-9766-7871d86df719", "value": "T1BB144A46EA414B13C0D7137AB6AF424A333297A493DB73069D286FB43BC379E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544042, "uuid": "133c94b1-711a-4080-b291-f70eca17eed2", "value": "6144:9MygR/fQdiYnYN4aTBMvlZe5cgCHMhMm3r5M/9pTKF:9MBR/fQAgYN4aTBMvlZe5XapMu/vTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544042, "uuid": "e142a64f-ccb8-4255-9af0-f4b95a397cc3", "value": 201506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544042, "uuid": "ced2c662-d110-4d18-836a-a6bdbec63ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544042, "uuid": "9519cb81-774a-42ca-9838-11b6caca2dbe", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de28c7e5-ce46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764546421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546421, "uuid": "502e3126-f871-4d93-b3ff-1fa0f5daff70", "comment": "Malware payload (Mirai)", "value": "086c943e09069dc23033d4bee01811b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546421, "uuid": "c1213cde-c2f1-4bd4-8141-df5069475ed5", "comment": "Malware payload (Mirai)", "value": "378d7204db5d5b6eea0f7362273a537e7e81cd5ebb3a0ff495a2c8166e17759e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546421, "uuid": "d025b563-53db-44f7-9d3d-1b5937864632", "comment": "Malware payload (Mirai)", "value": "2de6003d5d2ce34fb468479707353d94b4a374ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546421, "uuid": "13ee0c00-3276-461b-9984-e0254e536ed8", "comment": "Malware payload (Mirai)", "value": "e688a676c1991b75bc0fe33743168d0fb3f02095b51abc55e0b9933f256455bcd4f000e642645a51dd43f06a94195548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546421, "uuid": "663c3571-50cc-40ce-8cdc-258c213811dd", "value": "T159C33BDAF802DD3CF80BD6B644674D0EB921E3A156835F26225BFD93AD331A4B813D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546421, "uuid": "eeef6e50-eb1b-4f72-b02a-c1ad007b820c", "value": "1536:OVI1MQBlUwbswLQ657zSwISXqDdkZRxJsdtHWYpL3fPu8lgxFkGOEVK5Kx5vjLvo:O7wLf5ESikXE2sL3XunXVhxNAp47Zt6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764546421, "uuid": "da9d885d-72f3-4572-86fb-f12650974c29", "value": 118676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764546421, "uuid": "0e8c3b8d-83e7-429f-811c-022285c9172e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546421, "uuid": "7a635718-8424-4f48-8b05-2168336f233b", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa85594-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540134, "uuid": "34dff14d-ce03-4ad9-943f-e0298415e169", "comment": "Malware payload (Mirai)", "value": "03d4cbc9d794062c4edf57f2ffcca327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540134, "uuid": "e2e6b81c-c449-47b4-9344-aea35f86efe1", "comment": "Malware payload (Mirai)", "value": "3886b34a9c980bf5f6d76798fd37506698516e123f22bb756fe6fb12674c4852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540134, "uuid": "0227a506-88cf-4f70-aaec-ef35b8159992", "comment": "Malware payload (Mirai)", "value": "dfcef9df97c04f78b9c494cf74177b96d8ca2f8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540134, "uuid": "d85454f4-6978-4251-951e-f9cece0f2818", "comment": "Malware payload (Mirai)", "value": "926fdda5936019ab7fc1c5666ff35eeb037de92f35e10fa730a032dca6b65f0ac32e741cef72e2cc993ced74987e1357", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540134, "uuid": "261201fc-dc5e-42b5-83c1-79cfb996091e", "value": "T169230261840E8EF165703C73DA95D783B9E11AB1C6673013D6280A3C3F65A131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540134, "uuid": "c8cdcb6c-476d-4ce1-a7c4-233b1321a32b", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3UQ9q3UELbUXfi6nVMQHI4vcGpvJ:gECFd+A6YHAxqLRQZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540134, "uuid": "2214c8e3-99af-4182-92d7-ca31ec0a8f96", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540134, "uuid": "6efd5546-7dbf-47db-9d81-71cd6978ed27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540134, "uuid": "b348f5d3-4d8b-4b44-9e38-66c463f52439", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae619e2f-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468173, "uuid": "a15e4097-1ae5-4f73-8645-3cbc6e525127", "comment": "Malware payload (Mirai)", "value": "7aaa314f66d67303e7a1769b9a91d042", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468173, "uuid": "3e8ec726-e541-48f2-8452-5c38de800dbe", "comment": "Malware payload (Mirai)", "value": "38f94df99e0a5ef8257dc20350f75bd3f5b9452388acf68bd16c90fa28adc3ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468173, "uuid": "f9610051-0930-4e15-ac1a-e6a89adab1a6", "comment": "Malware payload (Mirai)", "value": "91d76126b19288c5c7ec5a8e98b2648ab87d7e08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468173, "uuid": "660ea753-92bd-490b-ab1e-ce0d2b1c229d", "comment": "Malware payload (Mirai)", "value": "e49b34bbe0e7b94a845ce41e7d92d9eb38b3f30b289ed937e246a5bc4fddafdbc71890ce74ca7ba63f00373938f629b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468173, "uuid": "4bd12f18-afc3-444a-b3f9-01b749b81c5a", "value": "T1CEB36B77E82A6F58C255D470B0B59F792B53A99082875FBE1AB3C2744083D8CF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468173, "uuid": "eb24c880-322f-478a-9a4f-31a3901b166f", "value": "1536:yAR/i5Z2w5ebKgqU/C1kKCAq/46L0NYEB3IWRWRB3F5Yy4:y8q5ZKGPU/0LCvL093IWKB34y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468173, "uuid": "38c2f5ba-1602-462f-90fc-ceeff2dea0d6", "value": 113248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468173, "uuid": "aacac666-d336-475d-adea-27aeab5ae2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468173, "uuid": "8318ec99-6d58-456a-850a-ca505dd5a7f5", "value": "odin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b15f869-cd82-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764462047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462047, "uuid": "2cdba688-8d27-4571-85b8-33ecb38eec9f", "comment": "Malware payload (Mirai)", "value": "0c50d9406e48fe0b3e718de122fd98a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462047, "uuid": "f5bc688b-a0e0-4dd1-a874-3fae518c9f78", "comment": "Malware payload (Mirai)", "value": "3973bcb113d7e0bb1b7bab2607e90894c4ebabdb39b80a70ff8396f80b0f7b42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462047, "uuid": "91ffb9fb-1ce1-40eb-9cdd-8dbf746116ef", "comment": "Malware payload (Mirai)", "value": "ce96a6c55fe6ae079f438533a5fa4c6856c76147", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462047, "uuid": "b67312f8-f766-439a-8ace-961737f14906", "comment": "Malware payload (Mirai)", "value": "38f39365dc120cdd2b6d3f2da9ffbafcca1ec25c503d085101e4605c39f8eceb49a904119d25e46f358cccc466218b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462047, "uuid": "3bc65f05-1d35-4196-8a83-f43a77d4430f", "value": "T1241318662D45B2BCDDF60078B49320A114A3453C3B8CE6F37187A83AEF75F097698E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462047, "uuid": "9dad07fe-95b6-4bb8-8aae-91966397ed56", "value": "768:LzU+c++Q5TjfjW3MGsjcFbJBZU/ogjlJHs/F:Hpd+0T3W88FbJBZUXQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764462047, "uuid": "b414b46e-33df-4b59-9597-376f384f0019", "value": 42328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764462047, "uuid": "47d367af-d881-456f-a8e3-80505439da16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462047, "uuid": "bfe428e5-9cde-493e-890a-fed9c18c1f49", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3457ddd-ce36-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764539477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764539477, "uuid": "ca89bbfd-f159-46e4-aa83-1ff0427824c5", "comment": "Malware payload", "value": "e79f7fd9ab2cdee13c4d49b01972ec14", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764539477, "uuid": "b8626de3-7597-4f92-bf87-45b510e92b84", "comment": "Malware payload", "value": "3a1b4089fad250b07cfbf212fccc688b4c8855e87108a1f4a7265257897dd7a2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764539477, "uuid": "e78c6711-f8b6-412a-b4dc-820194b6f0b7", "comment": "Malware payload", "value": "6498949d91ed7a9d33fd9d6d4ed6ce9d4d34ee3a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764539477, "uuid": "70de3c8d-3453-48de-88ee-66f21f4a05c9", "comment": "Malware payload", "value": "0d76fd3a1e1601c75f33afd779e838afff1ab49d7b8c51c82059497ddee2b39619abd55617f5be154771fa2aa79e63e8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764539477, "uuid": "77931dcf-78c7-4cfd-9d7a-0ebbba469e1c", "value": "T19744BE6C36D31D8AAA718A5EF4E0D043BE2984C30D29F6CD87CE06AA67CF4A547F4535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764539477, "uuid": "6e157f6d-d540-447d-a049-95e2122f2d12", "value": "6144:zNOZputdwgKeEf9r8q/dOIP+J5cV9/wz1eWaT:UIdF19gwz1daT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764539477, "uuid": "73fbadfc-f5c2-4d18-9b42-93ffa195569b", "value": 255412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764539477, "uuid": "4a9ec53b-587b-4c89-8695-a865b8f6c77b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764539477, "uuid": "91ea482c-ed54-4890-b613-1172cc8b6fa0", "value": "uwu.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666c3f24-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468052, "uuid": "04977280-7bdc-400c-88ea-a10d030a1374", "comment": "Malware payload (Mirai)", "value": "8808aa71ea5c1b8e7bd710d65b178bb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468052, "uuid": "4fff9fcc-38ec-43cd-9c6b-3c757fc1efa9", "comment": "Malware payload (Mirai)", "value": "3cc343008709a3cd016bcc0e709f36eebbca19d6cd234d98df12bcf54242da04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468052, "uuid": "6b7c363b-c76f-4d03-88c9-7f5f9752319c", "comment": "Malware payload (Mirai)", "value": "2f0d91dc9199b7293e5d648068e582d19b5c1bf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468052, "uuid": "895947e3-56ab-4581-bb6f-a4593a546f13", "comment": "Malware payload (Mirai)", "value": "7e4d4264471d3cd584c98926384a2505194fbe2e0abcdc1b276e4752cb0f14326817fd063fbce28f067ddd944da5a744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468052, "uuid": "2679c32e-1172-47ed-b625-49544edb06f3", "value": "T187034B3282395A1BC6C0637711975372E1FE1B842190875F7E6A0D9EFE5A3002B7B7E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468052, "uuid": "c9e38119-709f-4f47-b0af-92aab5e29f03", "value": "768:5yjhIhCBYqfi8FJf3VbdwpaN+tNLBp/13bFl59We4+wV+7:gn3pf34tNn/13hMZvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468052, "uuid": "1d11ac86-4cb6-4b6d-bba7-c7a81ec315c0", "value": 39520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468052, "uuid": "a6a8867e-401b-4777-a33b-bf468075871d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468052, "uuid": "80ca9f4f-0063-4393-8bea-a82a01603de1", "value": "irannet.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ecadbd-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468182, "uuid": "604882c8-737c-4f2f-9bf6-000789c8928f", "comment": "Malware payload", "value": "ec9ba38ce27e0c936f6f45bda2eec0e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468182, "uuid": "9b74bf0b-72c0-4447-a496-ebf7fd9b3799", "comment": "Malware payload", "value": "3d6f8bc6d911441bac88de85f9b6270b36fa6e4206f11b5f8bf39ca03bb8a264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468182, "uuid": "f20d0be4-0a73-4b38-b870-8f8d3548a7f9", "comment": "Malware payload", "value": "df5d57791cf954236ed3e637918d2a0c4b074a8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468182, "uuid": "37fdeae5-f400-4229-8186-0f98c3b2e610", "comment": "Malware payload", "value": "48d927f85fd6d37b48346ffe16c5d51e43e2cd75c4cc117db40176ca68cf69242b547b64a2bfa607f6f960437db9d056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468182, "uuid": "493bc228-b8e9-468e-b10d-5db18c091a6e", "value": "T15A65338109C32BB7FCB9923FDB753D8B3E5B56B46664805045EE216D83F69CB8291C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468182, "uuid": "88d22881-539c-4e31-b88b-e95f2d82bd3a", "value": "24576:aLmIzLYN9ElKKlKkqJPlhkYrKfTaZECd1uGM6L8V59zihiySxv5eJ7347WW/j5XT:aDoAKKK2LQd1uGMAMd0J767zprRZap9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468182, "uuid": "962e1b4b-0602-439e-9d60-8ab134ac76a3", "value": 1536596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468182, "uuid": "83644518-5d99-4b6f-81d1-4360d3ccd0ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468182, "uuid": "9e754a29-260d-4e7b-84af-2c3c84156b01", "value": "bizy.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034a6e5f-ce43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544766, "uuid": "e46650d3-9543-4e9d-8f99-4e93b836c259", "comment": "Malware payload (Mirai)", "value": "327a4dd150e568aecfd1a0b6744c59c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544766, "uuid": "cc2864cb-17ed-4142-8f85-2b03b78fe601", "comment": "Malware payload (Mirai)", "value": "3d902087639ab9ad586c626cec342f803959e01fa0f269af2c0e523523d18f45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544766, "uuid": "e393ac40-c13a-4d04-a7fe-921d54c0dd18", "comment": "Malware payload (Mirai)", "value": "2e4a27816447a536de2b871912870a7c959a14b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544766, "uuid": "dac03515-dfe2-4a63-a281-996b009996c0", "comment": "Malware payload (Mirai)", "value": "5733b138e0146ac67d09cd8924c9588ca3ea80828be1da5357569374b6404fcc4619b96027f5e183a458e6b1add6e134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544766, "uuid": "30bee970-117e-4131-bd06-0b9acbbb2de8", "value": "T15DB329C0F98B81F6C40B8C306166F63FDA31D9A95171CAADFF959F36EA37601920264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544766, "uuid": "35c32f74-73ce-40df-9056-a591707aff67", "value": "3072:fTm/iNJ65Sfe/CsFuT09dZJXQXireDHGKgpuzFlo1OUg:q/ij6i8CsMTMXgyhcQ8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544766, "uuid": "95291631-5960-438e-a17b-d75d0e75b4c3", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544766, "uuid": "4afd497a-c053-4400-a0f0-ccf67acb83c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544766, "uuid": "cec6c2d4-3858-4dbd-8aa6-b9dd5eef97ae", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410addd4-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496766, "uuid": "ea5efb71-edab-425a-9946-64bfa0b68f76", "comment": "Malware payload (Mirai)", "value": "c61b347c9b41b766cc48172413686457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496766, "uuid": "e848644a-4505-4212-ac2c-ba3733595660", "comment": "Malware payload (Mirai)", "value": "3f6d2c7c934322802aa44ca17d27876e49f950255c92ebfe276b01053317c0f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496766, "uuid": "4fc57e1d-3c73-431a-9e7a-c8c530056193", "comment": "Malware payload (Mirai)", "value": "ceca10ea50aa3c6a92f1c08f9d8a0b209db0dd58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496766, "uuid": "999a6726-0022-493f-a0f0-c97bfa20265a", "comment": "Malware payload (Mirai)", "value": "6b5e19c38a78fc662e3635d61070d18b1627a24e9a41d9ce50ee75706fb75ceeddf23fe38a89b04707d33216e6191416", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496766, "uuid": "d63efe35-efa9-4b04-ac16-c9a70e66b5d6", "value": "T12CF34902B30C0A47D2632DF02E3F2BD097EFDA9121E4F641651F9B8A9672D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496766, "uuid": "e63d9243-ac8c-401a-b751-1fc38003f703", "value": "1536:SW3bmyGKnCcQjYpySAxgDVT5vhiX+EFW+tk4lvAbRoeDG/t2ErQqh7M2IymQY2Ar:tLm3Iy4y5xAVDiFWokPbdE66hh1XjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496766, "uuid": "f54f0271-2a3a-4b67-85e5-d26ee5e8c598", "value": 158744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496766, "uuid": "f90e2fe2-fddb-4174-8bdc-abba070a2a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496766, "uuid": "877d2e52-9759-4240-be1b-256c4cf900ef", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44328ac-ce26-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764532688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532688, "uuid": "0833d60a-ee05-4ca5-8eac-e4b0c6f3a5e6", "comment": "Malware payload", "value": "902a42e226d8b4ea0502e3f7694bde8d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532688, "uuid": "fca352c9-c2be-4d65-8854-bc7bcdf0350d", "comment": "Malware payload", "value": "407cd4b588da7589683b1bef08a736c72e1c88b44c51e7ffbceb84683844afa5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532688, "uuid": "87823d36-56cd-48db-a007-19e69537245b", "comment": "Malware payload", "value": "33d22a9d9596e912d641379f2c75869ac5b23622", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532688, "uuid": "703e2032-b03d-4fc9-b46d-b1428bdc8933", "comment": "Malware payload", "value": "cecf4253f71b98310dd3102e3efca81130fc16f1ebc5a8fc98b2312b453b3536ce7da0b92e99a2007fa7333020dde750", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532688, "uuid": "d16e251c-1ea3-47e2-bace-9992e38df12a", "value": "T1E3C733D6B4C09C2F146A4E437CFB89CB1B37D4C94664126BD22A8E19FB573439B22B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532688, "uuid": "9483331f-ff41-4ab9-98a9-436328daacdd", "value": "1572864:jByNBosre5bUXNY2/GBApBGLyS4DuhuzxY7A0fK6gn:jMoD462mApBGLNlhhy6gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532688, "uuid": "2cd055b5-d8a8-4fe1-899d-32954339ad93", "value": 56114484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532688, "uuid": "7c367324-28a4-44fd-9372-1fe7c7900fe3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532688, "uuid": "bc329408-f736-4818-9ffa-996c096f0a81", "value": "2025-06-24 001.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e03347-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494219, "uuid": "20984771-8ec2-4be9-a891-2f18b5590adb", "comment": "Malware payload (Mirai)", "value": "62b421ecf82bd3d7b1fb63327147f863", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494219, "uuid": "73b0d2c6-b9f9-4405-a277-444702cd0529", "comment": "Malware payload (Mirai)", "value": "40b109e03d79821c271a710477e7e863539047c7532e6990303ac41af0bd37bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494219, "uuid": "35c5d31d-b53b-4673-ba9a-e751fe09d5f8", "comment": "Malware payload (Mirai)", "value": "7379aef24a9f32c6dc48f2a9375b3ac0c511d0f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494219, "uuid": "a0ed3d9e-48fe-4a0e-9c87-7c2d250ce81b", "comment": "Malware payload (Mirai)", "value": "46092dc03082b4ab467af892aa363c8a52c86c442be86d05f5a6ebc479c87d359481e58f4f3e51e3ca727fcb14716c69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494219, "uuid": "a660ea2b-eac9-4442-a82e-d519bd4cc5d6", "value": "T1E6043BC7F900D9BEF80BE77648170915B630B7E210925B337257796BEC3A0991927ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494219, "uuid": "1dbb83a5-2c45-4c5c-9ab3-61a73e9f7568", "value": "3072:BptxC/QIuc9Uck8m+9V64KJ96mVNKVijbi+L64ASMyGyJ/uh/FERf:3txC/QIuum+9VFK7jVNXLOyGwJRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494219, "uuid": "31cd0de9-150b-4763-a463-188307c8c781", "value": 175744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494219, "uuid": "cf274456-dafe-4104-bc19-5be4e014ff78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494219, "uuid": "a01d6b77-5708-4e9c-a9d1-1e21329890bf", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f676af6-cdb1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764482321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482321, "uuid": "b7c21d4d-556f-4939-bc02-157b2d6ceec6", "comment": "Malware payload (Mirai)", "value": "7f0e7e33ae7f452394dbe9e0dc434a2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482321, "uuid": "1953a416-82f1-48d8-bb08-efb7290de77d", "comment": "Malware payload (Mirai)", "value": "40e4741e1d2dd729186d95c205279ce1fef99d27bc188ebb1f409e40856296f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482321, "uuid": "17e926af-50b0-433c-bda4-560c7af71b5f", "comment": "Malware payload (Mirai)", "value": "a1fd21fac203c3b4912288cb94076a09702dd093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482321, "uuid": "41f67210-c91e-43d0-a867-55ef8e620512", "comment": "Malware payload (Mirai)", "value": "d8f852468c4ee07e06bff9a77acc824c9377b35e76961678b39f2c794fcb3ccc304459fe8b4d4af6b2f00d7f2ff09b29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482321, "uuid": "ee84fce4-ae22-426f-8495-db96d862f98e", "value": "T18E430110B7E33935E038C8BFED2616820E1A3D5A91663023365A659B77D0C13DF69BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482321, "uuid": "2be4c154-57a2-4f03-8737-31f22df6260f", "value": "768:F7HQnvd+rl07YvurpxDnDwa6NM85iL28gsYTWUpxxfcmD1c2EBKhW5eVqNNKqNzp:F0n1DYW6w2fvRpRc2EB0W51Noknoz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764482321, "uuid": "3b299bdb-b8d1-4542-b8bc-256677661742", "value": 60376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764482321, "uuid": "23d45e95-d743-4c7c-8212-5ea44b1d5f35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482321, "uuid": "909d657a-790d-4291-8b6f-e67c8f21af63", "value": "irannet.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17da3d58-cdaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764479087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479087, "uuid": "02f1bd11-ceb8-4d6a-9267-15ca3a6776b1", "comment": "Malware payload (Mirai)", "value": "4a422939f8624335428f6bf42438a3dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479087, "uuid": "0ae82301-b7b6-40dc-bbf8-4fd2fc7441da", "comment": "Malware payload (Mirai)", "value": "410caca7db9b343e5d33e65293bc312b89efe957e17ec697bc768be97575651a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479087, "uuid": "3af711a0-7f5c-45d5-bf86-b5b00724deb6", "comment": "Malware payload (Mirai)", "value": "e1eed9d30031ded7c781249188a7dfe6ad573dc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479087, "uuid": "8bf7060e-1c8b-48a3-a0d5-40572f218478", "comment": "Malware payload (Mirai)", "value": "84b440ba4e8a232c03efa8ff162a5f7dcdbe7523389f65e038d6c0b3c7c27690bda83ef2677a0c30eb2fdd453a3c9dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479087, "uuid": "1ea5ceea-7d83-4436-87f6-ac091c963126", "value": "T1AD83078AFD819B15C5D922BEFE1E018D335317A8E3EF7212DD115F14678A92B0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479087, "uuid": "d86d41de-b778-4d5d-a7e7-512a249ba138", "value": "1536:WdnD5WSjMs7fOnyouqb2UF2ppJH2ZJ3YA/QwdlbbiliMsKFtug7RcR:5EMbnyoDb2UF2pfH2ZJ3YAxciM7Ftug2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764479087, "uuid": "5d75b6bf-b7ae-40f6-996c-076e1646b810", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764479087, "uuid": "e151af19-b482-4929-81d7-99cc1ff86de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479087, "uuid": "a025e4f0-8da8-4c97-8778-dcea59817df3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c698370-cda7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764477887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764477887, "uuid": "ced3df4e-7100-4c3b-98c1-97f44f920891", "comment": "Malware payload (Mirai)", "value": "6f9287b033b7b8f4861e3f907f28eeea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764477887, "uuid": "90e05836-4441-4c8f-b186-6678c362fc6e", "comment": "Malware payload (Mirai)", "value": "41cb945f216c7ed7ce7034a20c5c591918c52b54a027494560c0d46e85683fc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764477887, "uuid": "a6f1a1c6-67f0-474f-8f59-8efbb3ca93ab", "comment": "Malware payload (Mirai)", "value": "16d7e3e1f353fba8783ae631d31c498400d32bf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764477887, "uuid": "2f9fff4e-e490-4866-b23a-9f51d4b33087", "comment": "Malware payload (Mirai)", "value": "72c92db7b7d9e3e2535e63f492fd3a99dd22941d20cf7366bcb44882a934d3b0e70900cc344e41ee1b9a380db3ec8306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764477887, "uuid": "9e4c694d-b07d-46bf-9bb8-943644b56753", "value": "T19B434BC4ED53EAF9EC0905711A77F7329A35F0791024FA87E794E673B80EB01A14A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764477887, "uuid": "982f5c50-a890-4ac9-9efb-07f9e7437cc0", "value": "1536:XGHqensXrf0LNB1WMODcY4YsNZ2hTYgRo4FwuULFhR:IqY+rf0pBLODcY4YW2h7R1FbKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764477887, "uuid": "216c56b6-d0ef-44bc-a0e0-aefac4884233", "value": 55508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764477887, "uuid": "b5080b93-cea7-488a-8a5a-670bad9b8f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764477887, "uuid": "21459601-ba41-4358-adcf-6a26a3634753", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4493643-cdaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764481604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481604, "uuid": "55632fe9-7f0b-4856-b7db-5860b20c03b5", "comment": "Malware payload (Mirai)", "value": "55bc4538075ae613e7a2dbc8e18fef94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481604, "uuid": "1623bc94-e835-49ea-9add-64360434f286", "comment": "Malware payload (Mirai)", "value": "4228ac1cb1e07f11f4db43557f7ca08fcc0fa35c47657644a7f4ce7e26252318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481604, "uuid": "51306dac-cb7d-45d9-888c-281321402aa4", "comment": "Malware payload (Mirai)", "value": "738e5cd509acb7b558ab1caff7cfc037b7deeba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481604, "uuid": "3f72e925-0c3a-45e9-bd75-3f747e547051", "comment": "Malware payload (Mirai)", "value": "5a5d4ed1811337a46f6306f67a2d1b11002e1ea7e922b8f531d4dd5d5bf9fd1188487baa7d43664d04273cc448a7b59f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481604, "uuid": "29ef6f3e-59ac-4b6d-9dc4-81d4025ce2a9", "value": "T120530885BC91DA27C6D462BBFA1E41CD332623A8E1DF7203DD116F157B8A82F0E67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481604, "uuid": "a90552dd-d55b-4ff1-9c6a-c682b13ae0da", "value": "1536:6cASciUdBSS+w5nO4SjcjrZMNwsExPealtug7R:VAScw4S2dxfltug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764481604, "uuid": "0d40b688-9079-4dee-a498-7f19edc71882", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764481604, "uuid": "9f8049f9-150d-46e9-95ce-36eebb5ee11b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481604, "uuid": "fadb477f-1b8f-4b46-ac6f-1a1d01f44b90", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc501bf-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468175, "uuid": "86061952-8fb6-49f1-9196-abf71c86b36b", "comment": "Malware payload (Mirai)", "value": "fc3b1aff60266fdefd274253ef1a51a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468175, "uuid": "9bdc508c-68c9-4453-822e-a32f795d8604", "comment": "Malware payload (Mirai)", "value": "42c98a7aaed9dfdb48a02009c3ef41c71bf0e6c3a8d5d3b9bab1bae6d8799d96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468175, "uuid": "73f2ac9b-cac4-492e-b2e6-3964f8a3ca1d", "comment": "Malware payload (Mirai)", "value": "48f677619711424ddf3fcb41b2f7a1b8971e1588", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468175, "uuid": "2c1ee637-c921-4630-8f3f-09cb3b405b6d", "comment": "Malware payload (Mirai)", "value": "1a35c880908a4d1611503d4e9c65998cbb3405142d82fb49da8669d7431f6751e30594d10ffcce745fbcc82eb9311a32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468175, "uuid": "f444cd86-b4ec-4e7c-ab7a-b724f2f9b5f9", "value": "T1B8D34B17B5C280FDC8DAC1784F9AF53ADD37B1A91238B26B27D46A231E49E305F1DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468175, "uuid": "ef69482a-1e0e-4c9b-9946-23406945be6b", "value": "3072:aDgjSxy5mzkUzSiC0m/waRbRmKh0C3YgwhCQUyeXJTEOu:aDgjSxy5mzkUzSi8RuUQyyOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468175, "uuid": "54a38eb4-49c9-4d49-bd0d-54a788e09c3f", "value": 139160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468175, "uuid": "9d3805fe-4d46-4550-bbd6-10ee99900742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468175, "uuid": "626cee13-353f-4f91-b47f-bf5491cf3281", "value": "odin.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df853f95-cdfb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764514211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764514211, "uuid": "f10ef6de-02ef-4686-a00d-ab36c79fadc4", "comment": "Malware payload", "value": "cbf2f31b8d351491aca3e7ce276ec32e", "object_relation": "md5", "Tag": [ { "name": "cvmega", "colour": "#635830", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764514211, "uuid": "8b321fb1-54b2-4972-92cf-c1e94fac763d", "comment": "Malware payload", "value": "4301acbc13a2a4999e560758eb92f54a5cae29beaa07578b97d3e408140d9fe0", "object_relation": "sha256", "Tag": [ { "name": "cvmega", "colour": "#635830", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764514211, "uuid": "f9267b1a-2b40-42fa-a373-65a3fd68ceb0", "comment": "Malware payload", "value": "f96ad1782b9f10e2a96f6b29b7d115c97f2db53c", "object_relation": "sha1", "Tag": [ { "name": "cvmega", "colour": "#635830", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764514211, "uuid": "da58d9b8-cc7f-4fb6-a3e7-905e5a958fe6", "comment": "Malware payload", "value": "e880b17be66277021011e085ad7e8ff367affcb2a4112fee9ca58040a484ddbb666803567f5f113c5c55e0c7161dc62d", "object_relation": "sha3-384", "Tag": [ { "name": "cvmega", "colour": "#635830", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764514211, "uuid": "c883f316-5e51-4414-aef7-2d02fb07253c", "value": "T19DA55B02AE5A88E9D58DC874C2868A975E2130DB0B36F5BF16C512383F6E7F56F1D309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764514211, "uuid": "1bd408be-10c2-48ff-a6ec-33cecb1314f9", "value": "20897be9ea59815545a704a6603b74d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764514211, "uuid": "b9f9eedb-4a7e-4b66-bcb9-a3ae2c02a7cb", "value": "24576:On3CLUXL+jCdrj8P6lSBNguiT15fgaAWH1vd00vaAfJ7tD:OSgKjSv8PTkd1vd00vJB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764514211, "uuid": "6400755b-6e3f-415b-9d5d-ee2d2a9e7af2", "value": 2176000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764514211, "uuid": "91e8dda5-35f6-4485-8451-581299fdaa4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764514211, "uuid": "c3d3e76c-ba1c-4ead-955c-8c6ecc40d1b5", "value": "pc_info_sender (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca16ab59-cdf0-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764509451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509451, "uuid": "4b3ac7fd-6d8b-40ba-a0be-903c88b47db7", "comment": "Malware payload (Vidar)", "value": "3e9f19262eab25913461382360689ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galaxis-us", "colour": "#1B6813", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509451, "uuid": "eb676352-593c-4aab-b79c-89dc0c6a2ebc", "comment": "Malware payload (Vidar)", "value": "4346c82cbd594255c67aad258030e9c55c4284ebf6294eb9635070c923b8085a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galaxis-us", "colour": "#1B6813", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509451, "uuid": "b8713b15-c146-4f1b-962d-ac379cda1968", "comment": "Malware payload (Vidar)", "value": "fc2b7fe7cf9b1616965483a4c28e9aacbb55f7e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galaxis-us", "colour": "#1B6813", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509451, "uuid": "4679ebad-c525-491c-af22-e9a0dd6967a0", "comment": "Malware payload (Vidar)", "value": "f955a0523f6c792e64f3ea91d4c08b81cffc5d482999cee36bfc9e074eaa95bf114f12d03a3a56990fc0e10dd3ffcd18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galaxis-us", "colour": "#1B6813", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509451, "uuid": "7d722024-2b70-4ad8-ad14-cb46db12b75f", "value": "T15CD623D3A8D412D4C8938BB4A28D17DD92F17F9AADA66B6D33C538436D31F878205D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509451, "uuid": "b6b78acc-3fb5-4bfd-9877-ab0bea3dd235", "value": "da0173a5eb427af15dad82d5fe30ecca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509451, "uuid": "2f902d70-6c63-48da-89d8-19cb789a5c6c", "value": "196608:kNtHiR+o9vW8NjIk3vOXqdGdPNeLnG62kZuPqX9Q1tCowbuXkLfJUJsdN7VoGm:CCR99v1RFUqm1eDsPqG1tU2AfJjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764509451, "uuid": "7782dbcb-9798-4cc9-8927-0731047abd0b", "value": 13725696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764509451, "uuid": "ad49a09a-ca96-4f63-bac4-ed6904e0be75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509451, "uuid": "110d082f-b411-437f-a014-9fb87fb661b7", "value": "G\u0430Iaxis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda3295a-ce0b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764521134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764521134, "uuid": "f6f1a930-6bd4-41dd-acae-22c9484bc52a", "comment": "Malware payload", "value": "89d1e0e82a4be44b918f404c23738a8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764521134, "uuid": "b1710924-535a-4c93-9e7e-618d1bd34585", "comment": "Malware payload", "value": "4354f1fd226019e3009b68392c691f1b37793fb1be8d3b22b18ca62e01113f36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764521134, "uuid": "b8c5614b-d485-4d25-b7ba-37dbcbfee157", "comment": "Malware payload", "value": "893eff8353859631d68ee844ea2db4a15ba96871", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764521134, "uuid": "c46a396b-04db-4fa0-be3d-71904fbe60a3", "comment": "Malware payload", "value": "0f7796b0ed058cd6b63c688aca0000726b82f54441104dd2a148f1807347acec5e408fdf0c7ab3c75237d3cdf8b9f8c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764521134, "uuid": "6cd55583-bc18-4595-b7af-638d5b7d6b4c", "value": "T1BF23F2F8A0C5B1A9E71033F6E62E4CA22B7D65363E5DC53534701F895EDE88A091E0F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764521134, "uuid": "3229d826-536c-4bb2-a197-76f18b8c3a98", "value": "768:Id/EIPJYmIrubyeDOgtLxDmUVqHn4pSzVdaQS4vy79t18T6CGi4cSmmly7M9Lo2H:ycIBcrqpDxtLxmUVqwSzVdaQS1w6sSmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764521134, "uuid": "9f733514-11d1-472d-9e14-4d9d279c1d96", "value": 46560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764521134, "uuid": "14cee255-1d87-4680-a95e-619a37936b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764521134, "uuid": "c682079d-b578-4d81-ad40-8bef8d3bf5ff", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2a7d18-cda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764476491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476491, "uuid": "7fd29b53-c211-405e-ba6d-ae3ecc20a03a", "comment": "Malware payload (Mirai)", "value": "9ea526f9939be190011307ab218cecad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476491, "uuid": "d2d74d10-2d7d-498a-bd30-bb8cf5d69d06", "comment": "Malware payload (Mirai)", "value": "44c0be5602fc0794d50542c38f161537ca46401866edd2130c855236a909bdeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476491, "uuid": "9caf90ba-7c2d-4ddc-91c5-41c9ed83e1bc", "comment": "Malware payload (Mirai)", "value": "b41a0471333f9173920bc45288b03741a2fb74e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476491, "uuid": "fa411aec-7f5d-470c-9dd2-6d28768fca9b", "comment": "Malware payload (Mirai)", "value": "1e9e571fd32468bc52622371960673da36c64f60d525f377f949908b2569f81cac22245ef3c918491a20f03ae2040ce1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476491, "uuid": "1ab42511-cea4-4b3a-abee-9f61c5a76a5c", "value": "T14B935D8AF793E0F0D94605B1112FF77D9634EE625024DE1AEBD4BD72AD32A01921B32D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476491, "uuid": "e9d6d8d5-4c70-4d4c-9bab-c63d94670b77", "value": "1536:NwoQml4aeGpPCPno2eudXzYKxQPGJymUi31Uj7RqWXOmKDZFntCr7c:a1ml4aeEa/peudXbxQYeZ5w/E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764476491, "uuid": "f90055ab-8fdf-4b4f-a622-cb4111ce988d", "value": 97456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764476491, "uuid": "5bdd14f4-76a3-4541-81f2-bcc8afac7512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476491, "uuid": "f68b3dd1-6989-469f-b3b7-7e50b9c51ad8", "value": "SecuriteInfo.com.ELF.Mirai-CYM.96733828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20223e13-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538801, "uuid": "68e6f55c-2735-4637-ada9-4aa7612b6f89", "comment": "Malware payload (Mirai)", "value": "d5fad1b89f7cba68ee6eea21fe3c0d77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538801, "uuid": "12e6a52b-869d-49f6-aaf6-ad4a2fa0c7d6", "comment": "Malware payload (Mirai)", "value": "4544122228460c4f8b1d16bc5d044b2a1009f9e3fe0ea3ca5cdc6cb2e4a99bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538801, "uuid": "8897d657-bbc5-46fd-a06f-26230af6871f", "comment": "Malware payload (Mirai)", "value": "43489a4c7b9be6f7be4440039e4470b463feb2e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538801, "uuid": "897a7ac0-86b8-4cb8-8e8e-075af1da6959", "comment": "Malware payload (Mirai)", "value": "0060ccc406c9b3afb63d1689c299b3262d3bcb71d37efd5f9948da3622ef821c76dccfaa75bfc1ab5ca1d5edfb849ee2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538801, "uuid": "351b87b2-b638-4460-be42-b3c05644fd9a", "value": "T141C32912F98584FCC0CAC1340B6FB63AA935F1DD1238B2EB6BD4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538801, "uuid": "02efee77-9214-405b-8ced-0d646f3f5ff6", "value": "3072:iY83TgBMfVw+Z7cHIzO8SoMFAIRHp9hApD7bhVzXzGszQgV8IattG2:in3TgBMfVw+Z7cHIzrSoMFAIRHp9hAJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538801, "uuid": "bebd42c8-75c1-4517-bf15-41b4020f6660", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538801, "uuid": "f2aeca10-3c67-430e-9661-86c82cfb57e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538801, "uuid": "52b8216f-bd42-4b53-99fa-779009f47e9b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892a3787-ce23-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1764531246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531246, "uuid": "1d09b51b-a004-437d-8e44-daac12239899", "comment": "Malware payload (CobaltStrike)", "value": "dfccd2b074d6380a61e70fa743f64d9d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531246, "uuid": "cf9e1d23-1cff-477c-899f-5d8a564fe05d", "comment": "Malware payload (CobaltStrike)", "value": "46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531246, "uuid": "83b898c1-6242-4455-91d6-7106097c79f6", "comment": "Malware payload (CobaltStrike)", "value": "310ade16a531c195a1db4a84968fb935f7ba5bd1", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531246, "uuid": "1db695d1-a7bf-4042-978a-a705dd63c902", "comment": "Malware payload (CobaltStrike)", "value": "f2002ff94e252a7cd73d52198c704aec50613029a31e4eadd107a6af06b9bddfc62ac6ed6475a133bd203c96b9dd4bc1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531246, "uuid": "e7975ce0-b78f-4452-b8c7-70fbc819a042", "value": "T13FA24941FB860DFDEB2402F2C033421AE0B6BE39176186CB0B79B1192D7279165763CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531246, "uuid": "282d6c20-8a71-45a0-9244-ac92a8ad88fa", "value": "20662f6d8d201a1288617fb796340672", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531246, "uuid": "d21f474c-cc18-4963-9293-32777b8680eb", "value": "192:qkRMw9ZO7tol6uouB9j4CWvKhkX6GgBzh+ErA8lxk3Q5tfL3+umf:h9ZO7SHouB9jovKhUIbi3OOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764531246, "uuid": "93ee1ad8-6456-45d6-bd51-88cdf1de17cd", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764531246, "uuid": "235d62e4-b74d-4456-9faf-5af424bc6c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531246, "uuid": "c867f849-1f60-40c5-84b2-aad9e27e1e6b", "value": "tufaqixiang666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb6cb53-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540164, "uuid": "164552e0-a1f4-42cc-bf27-e4913043fa2b", "comment": "Malware payload (Mirai)", "value": "3b7a097f42fb175e9fe36f282f4cea1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540164, "uuid": "09dfbeaf-f1d0-4995-a2a3-5bc958b5251e", "comment": "Malware payload (Mirai)", "value": "471601a3974d8850720ffe3aba19823a24e09d70103fec5a83bc3a9e580136e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540164, "uuid": "514ea727-c2d1-41aa-b8ae-22366a125d1f", "comment": "Malware payload (Mirai)", "value": "e1e17f8be91c8aaa547e1cc36002aa9933ce631f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540164, "uuid": "691a9100-868f-4dc7-a11e-3666df79983d", "comment": "Malware payload (Mirai)", "value": "a0dd2556c293f2a940123188d5d2cc41cead1e915e7f97f3963faea8a0a818cc625c73de9bf19f80dbcf31aa4a0106cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540164, "uuid": "5f8c1939-6b0e-4991-b2d1-c88b26eb284e", "value": "T1EBC2D0E07726FA31C420AC7DE52A4D8A3A510A3C90FF393764258D359FC165B63F88E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540164, "uuid": "0ddad41a-2408-4b8a-ba68-919ee4a1df62", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwr59q3UELuC:NKy4qfqoeJdXWgsLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540164, "uuid": "cb6a4248-389b-43a3-893b-63ba6243966b", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540164, "uuid": "2d5eb5d2-011d-4cf2-aa6d-ca4dc95cabe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540164, "uuid": "dd73103f-27cc-4725-9996-1df608451467", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b12937e-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496729, "uuid": "e2f3ba66-05a4-45c3-92b5-d20b2faea88f", "comment": "Malware payload (Mirai)", "value": "7eaaf01e221eff6cf7687aaee44f23a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496729, "uuid": "abe600b0-2fa5-48eb-a476-a1dca3bbd1be", "comment": "Malware payload (Mirai)", "value": "4812c30e1192996c0ccb8c2ff3049a25da367191bd48f291b7644b2c6abeb52d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496729, "uuid": "077c6825-26cf-43a0-a75c-26a423d9e611", "comment": "Malware payload (Mirai)", "value": "d784e0205517c12606f7e506728cf620bc379da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496729, "uuid": "88a91bd0-5f23-4b86-850c-0c7e8fcd1a9a", "comment": "Malware payload (Mirai)", "value": "cc283c770d6d700dc1c72479a9b6b97f59dadb740437fcba519e4e781e434baae44cc1beddb0de8cfbc0600aa8db6397", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496729, "uuid": "b0e59d20-91a3-46ab-808f-5a77cd390b8b", "value": "T17733F2BA9612A6C0FF73FA634C8BDFF4AB2106A1E75B87C15246AB0025671B93114FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496729, "uuid": "8c30864e-d8f7-4476-9e66-159bccbc0cde", "value": "1536:fVaoF8CDX+KpdO7URfCYerKAa5UKFu/AjINnkpC54u+qgw09l:NaovZsIRfoPaaKYaYMo4u+qgwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496729, "uuid": "2fa8f7e5-9c2d-41e4-a5a5-878369924f11", "value": 53124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496729, "uuid": "4c38fcf3-78ba-4623-ba00-6443c23521d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496729, "uuid": "9b6a1d0f-8a72-4f42-983f-bd8ff7cea736", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f81869-cda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475136, "uuid": "0e41382a-9f87-4929-aadc-6cb0d8fa4b4a", "comment": "Malware payload (Mirai)", "value": "a5136b7bb57143f2d7a270ba381eda33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475136, "uuid": "6ef2760d-9cfd-47fa-90fe-a2e3c7e56bf4", "comment": "Malware payload (Mirai)", "value": "48b8674c5a6f59111231537d3d32442dfa765726165238a1face564c850a386f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475136, "uuid": "a771a2b8-bf36-4924-85d9-ab0084ec2852", "comment": "Malware payload (Mirai)", "value": "77333b39905ee75555ce4f329dce8268d00d8e3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475136, "uuid": "7febc98d-7cf3-4648-aa20-b17b9b148bca", "comment": "Malware payload (Mirai)", "value": "30d932880d6a188de0271c1ca29992b6760b68109b951a6d896313d7b0b3d7c94fd0da2e4fcdab8afb9cb4b35d88c6e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475136, "uuid": "19b63c1f-aac8-4eb7-8d25-fcae616c4e76", "value": "T11653F1521212C676DFD61532AD15E90A571E8BF8FAAD785A0384E81C33F004EA6FF813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475136, "uuid": "b13dfe80-550e-4b65-8ad3-606ab484dc3f", "value": "1536:n/PAx69bfmyB/03E2MDOj2OOSoMvxVa8J90ow17h:nc69rX/0KS2Uo2xvJ9g7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475136, "uuid": "89668f82-58ac-4f31-9b68-44a4bc64cfbf", "value": 64136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475136, "uuid": "f13ff4d3-72fd-4b0b-ad40-38ea1cb62abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475136, "uuid": "e2d0e07b-7de8-489d-aa90-78e4fea5ceee", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98520699-cdf2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764510226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510226, "uuid": "bc7f6056-f414-4010-93fb-ac7b78974027", "comment": "Malware payload", "value": "d3d18dd331557bf72c0a695aa3f6ba8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "js.agent", "colour": "#64B5AE", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.Generic", "colour": "#190735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510226, "uuid": "bdc8f17a-5e88-425f-9492-cd2ca0aeb7b1", "comment": "Malware payload", "value": "490c671c268926566d61992da090ef186c1a8aae03926c056819c5e0fac13cf2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "js.agent", "colour": "#64B5AE", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.Generic", "colour": "#190735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510226, "uuid": "c3946baa-f398-4f93-bd33-ff5484588049", "comment": "Malware payload", "value": "07d5b82fc9971d8fcded6f502cc43de3ee4dcb47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "js.agent", "colour": "#64B5AE", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.Generic", "colour": "#190735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510226, "uuid": "8e09b03b-a6ad-4936-929f-39c852c2aaaa", "comment": "Malware payload", "value": "e1ddc9901a0cdbab364c01cc66231bdb324c7cd2968e7983a970b43bde63b55e004fb987cd938f85dd1944d234bc5cbe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "js.agent", "colour": "#64B5AE", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.Generic", "colour": "#190735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510226, "uuid": "aec04751-ce10-4446-847b-30ea694bc531", "value": "T1A104EE9463C0E40767DF5F53FF0AB9E9E46A98767888640BC254BFAC68BC107D5A0DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510226, "uuid": "615770bc-899d-48b3-9a18-c030d205421b", "value": "3072:m9QXx0yfj9iejaUALXKcaRLeePDCM+hjso+qj+tux2urq/JmdmyG6H:m9cx08jCUALXKcaJfPDCMajso+q+tukQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764510226, "uuid": "9125b3e6-b990-475e-bb89-2c87ebb3d647", "value": 182509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764510226, "uuid": "552ea17f-0b2e-4284-b754-826fc47ca8a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510226, "uuid": "d9d1a03b-b6e9-4ec7-b854-5087c6586e88", "value": "843a8e03-64f9-4a3d-b11f-15f7837f218c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0abaff-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468174, "uuid": "874b8ec9-ccdc-4ca0-82df-313ee16a9389", "comment": "Malware payload (Mirai)", "value": "0713578cbe976b1546952e0c855c7023", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468174, "uuid": "a37160e2-30bd-43e8-9822-a5f88d21cf73", "comment": "Malware payload (Mirai)", "value": "49bdea75a582c656e0b7c07fcafbd9d3ce01bae6c7802cc87cb2b9419c89640c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468174, "uuid": "debac262-e7ad-43f8-bd8e-c05b8990360c", "comment": "Malware payload (Mirai)", "value": "9d2823045571989781a7ea54133f6c3f9055d69e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468174, "uuid": "a9524ade-62e8-4d85-868f-1cbf837df669", "comment": "Malware payload (Mirai)", "value": "d242f6b976e771d6a456e75c65de767d953a054161bc531e4eb16395e3645ef2b5801ca5e8090f831352e248ab37a73d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468174, "uuid": "388c2551-22f5-4e9b-9cf3-dacabb8626ed", "value": "T190E32AD7FD00CEBAF80AE33A485309057630BBE145925B372257797BEC3A1D91563E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468174, "uuid": "91d2491a-9da8-4837-92ab-8e43f14c5d77", "value": "3072:TvFmJU+koa+rqSHNKqhgCV3jbikLwkayVuU46:T9arrqSHhhgGLOyVV46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468174, "uuid": "3647b1e8-5f6a-48b3-89b5-002dbc10051c", "value": 144512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468174, "uuid": "491c6354-06c2-45c6-8ca3-d0ff7b449685", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468174, "uuid": "0c0981a7-ac10-4756-a929-0845a0292334", "value": "odin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5be67b-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496763, "uuid": "c46cee5c-5950-4185-a2a5-e6370eb4b2b7", "comment": "Malware payload (Mirai)", "value": "948f9a55b5ff1f1b205e3a9c999f76ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496763, "uuid": "17447ac6-7d6f-4aff-ade3-35af186bddb4", "comment": "Malware payload (Mirai)", "value": "4a0ff91b15de6fba8012993023f2279806abb8e391104ffe7808f6731798a531", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496763, "uuid": "ffda1cbd-46c1-469c-9e7e-fcc7194c7344", "comment": "Malware payload (Mirai)", "value": "aea86040ae0f11f55a7844adeca14c0cf6650c60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496763, "uuid": "001a7f28-542e-453f-bdc1-3270265e7e95", "comment": "Malware payload (Mirai)", "value": "95db8bb3647254f9f27aa1bc1e13549d97469b2717099ae684845f3a0863f5801c218ac88f7e82270a57b48d7ff91ba1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496763, "uuid": "1fbfff68-2361-49f2-888f-5f8253594275", "value": "T159243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496763, "uuid": "e5721602-8462-48ce-aca3-6b8fbc60b598", "value": "6144:tvERpNp86wShWU3NmaDTsOZWuv7wKeLxrkQ9M/RBGnwmH2WBLB5n:iRpNp86Z3NmaDTsOZWwMpyQG/enwmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496763, "uuid": "4fc0c06a-5aff-43db-be56-a5d5cc7e9a67", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496763, "uuid": "0cba0922-8031-4e03-a98e-98f2240f16d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496763, "uuid": "ac88d3e8-248a-464c-842d-3379edc3d04c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c641c6-ce16-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764525516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525516, "uuid": "ac997f10-3db7-4247-bff4-cdb130727067", "comment": "Malware payload", "value": "bb0924104ded55c79c38794cb7a4ac24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525516, "uuid": "d8cc425d-1930-4f02-b07c-f683482c1bcb", "comment": "Malware payload", "value": "4aac4592ec8c478f93614eac5356f5e0ea924b74014b8f252de8ab67ad198881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525516, "uuid": "36abe9b8-d376-4e54-833c-1922d08b5844", "comment": "Malware payload", "value": "ad77322bccf94f2036705cd2269d237d9fbd5d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525516, "uuid": "b0dcdfa1-35f9-47ad-9f86-6be490d4dd22", "comment": "Malware payload", "value": "8022d994c00e61a994947e6117934b5d09a2b46c79d38e52567e429566990d70f8b7757cbb6484614e6f66bffb06ae93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525516, "uuid": "49687e6a-9bcd-4975-87d9-a931bea0453d", "value": "T136434B22B93D2E17C0C5787A61F34224B6F2274E36B8C65E7D721E4EFF256402117AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525516, "uuid": "936993d7-c509-4a65-a588-1f0ebeb3ba09", "value": "1536:qo79ySPa4HfMyPUqrWGZe5/wW2qbw0vJhnwteMHC:qoJ7f0yPhyr9UQnCeMHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764525516, "uuid": "6a192533-53d3-47ec-94a2-a10fd90d45fc", "value": 60368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764525516, "uuid": "72df25aa-0417-4fe3-808f-e0ca318caef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525516, "uuid": "4b13cb12-8548-40cc-b8ff-3e3d8c832bda", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd65812-ce02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764517000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517000, "uuid": "d2528c34-b5ad-4a6e-a84d-5585ff8143d0", "comment": "Malware payload", "value": "fb045e4a66a29a35dff013bf8d3d08d0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517000, "uuid": "ddcf5cbb-49f4-4e24-abee-b6f2c65670a3", "comment": "Malware payload", "value": "4b0987d7b57e4a87325f127ca2b44893034a5f332c9d319fe06cd9fd11e4a1d9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517000, "uuid": "c7381db4-3ab0-459f-b4f7-53c46dfecbe5", "comment": "Malware payload", "value": "86c97c07ffff3441312c819078b1452a410e514d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517000, "uuid": "b0a00492-0589-4d80-b81e-2d296fe59ac4", "comment": "Malware payload", "value": "e499323fd3cd79b12915dfb5b46dd27a2978f6ba1e22c55520949cc5f1ad139791500cdb0944127e576bd1df0a40496b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517000, "uuid": "bc8e0792-560a-46c8-8cac-9832c033cbd3", "value": "T12C167B436D62CFD6D18AC33ABDA222C276B578404B352BD30A5066792D3B7CC5C77B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517000, "uuid": "cb18812a-9b02-4ae4-96b7-04ce2fff94f9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517000, "uuid": "b71c1763-6c7e-45a6-aab2-3ca296447cdf", "value": "49152:4g1KfmgDNvjc1UJlMKvAayR7yPeFb0jddgU4L3cOb+0jiNnG7KKe0fqExZORBF3I:4FH9ktTdqMbX5nqafxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764517000, "uuid": "f4887a85-4083-4953-bb5e-874bf044dde6", "value": 4283032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764517000, "uuid": "5b9568f8-cf98-4233-a8a5-acadaecc2732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517000, "uuid": "e81fe48d-571c-46dd-ac78-2a1971c3a014", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8fc7a8-cdf1-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764509702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509702, "uuid": "0bbb2c1f-e545-4849-aa6d-7a1b504a6eda", "comment": "Malware payload (CoinMiner)", "value": "e750a5974f7ca7de8323b0b142638510", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "luxurycheats-live", "colour": "#DC1CF4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509702, "uuid": "0a1b7ed2-133d-49bd-a29c-e7318181b053", "comment": "Malware payload (CoinMiner)", "value": "4b3218359d27397aec490b71332841279d5ba9f8a0466e47173c8f24b93f1062", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "luxurycheats-live", "colour": "#DC1CF4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509702, "uuid": "708d58e2-94a4-4858-b409-107a55c34e3c", "comment": "Malware payload (CoinMiner)", "value": "f70635fb79d9a29273fb1298a73fcf29fa9bd3f0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "luxurycheats-live", "colour": "#DC1CF4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509702, "uuid": "719bc20b-3902-4dd2-bb6e-fcf0a1252717", "comment": "Malware payload (CoinMiner)", "value": "fe87030c31f7bf6c76fda85ac3fbaca1602ac0960f828cc9445d043b2b1cde08ace14871bfa92b3465fa2223fdc361b5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "luxurycheats-live", "colour": "#DC1CF4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509702, "uuid": "42f930b0-b523-44a1-baab-a97a46cfdee8", "value": "T1CF773367D8BA0267DD79B4308578F28D98C1BD31AA064132B31D723B9FB379136BB446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509702, "uuid": "9fa2c6e4-e490-4d35-8f79-667fe8233844", "value": "786432:gKkVcRO5KL7uM8CkztZhIrzu4fa3Q8T3AJ6HB4DBvi3bk:iZ0LCIaZhIraBgOAJ2B4Urk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764509702, "uuid": "08c16706-dc07-496d-9311-da3c861cd42d", "value": 33054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764509702, "uuid": "e9a6a2be-9259-407b-b8a8-d63244855190", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509702, "uuid": "8a5b5d76-ea0a-4719-b8fc-ace341502714", "value": "UpdateAgent.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b14ea99-ce1a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764527196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764527196, "uuid": "1b2b593c-8d25-4887-8bfb-981fd2e64ec5", "comment": "Malware payload", "value": "f796ea7f43fcec3d602ae73189c6608d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764527196, "uuid": "626f52f3-56bc-4b62-8478-9808e3e062f8", "comment": "Malware payload", "value": "4b55274a8cfd8ba549b5b72777b0ff45f80f6abff8270e516cccf8efd91e92df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764527196, "uuid": "ead8a3a5-9351-498f-a7ac-25681ad07bb6", "comment": "Malware payload", "value": "351dafd5afafd47731fb56c3eee5e0c3501243b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764527196, "uuid": "15d4754b-5532-4be4-8a90-a0b17058cd0e", "comment": "Malware payload", "value": "0017490142cbee94b6260eb17a95d747a7dc1117abc90f8a7e29723633c950df8dbc059444cf49c72216a7e95c59aa58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764527196, "uuid": "e39671f0-df48-4c1a-8ea9-163142ca9b0b", "value": "T165435B9AB4019D7CFC4BE67FD0130A45F5707B2665830F2BA3AAFC936DB21644D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764527196, "uuid": "c9da39ae-b94a-47f0-9d69-7a81c6d0aec9", "value": "768:IKeVexbI2x+rPPmcGkp7HTvUNb8+3S0rn8OLSpYiBb8w0AX83Eb8Fe6tp:Zgexz+rj7zMxxC0TVLSpdb8wbXMG8F/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764527196, "uuid": "7926ca4d-9285-4692-83b4-cbf1faae6900", "value": 57200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764527196, "uuid": "8d0a8c68-6dcc-4399-bc9e-efa15fed715d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764527196, "uuid": "d6f8fd62-100c-4ec3-9e5d-f2c01f55ce46", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4021bdaf-cdf7-11f0-a129-42010a9c0007", "comment": "Malware payload (GhostSocks)", "timestamp": 1764512226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512226, "uuid": "057611fe-7b16-4898-9f8c-dad1256411f6", "comment": "Malware payload (GhostSocks)", "value": "efbc97b2e32d5876b07922a2d7241cec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.Agent", "colour": "#F4A617", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Agentb", "colour": "#7A25B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512226, "uuid": "7ebf0b97-047c-4fbf-8beb-4bf7a6844a01", "comment": "Malware payload (GhostSocks)", "value": "4d1efd06b57f610e1ac066543d08176eb48dacd932eeda5735dfcaf6bf493573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.Agent", "colour": "#F4A617", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Agentb", "colour": "#7A25B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512226, "uuid": "67e693dc-ffd2-4dd9-9dd6-4cb3aa55a716", "comment": "Malware payload (GhostSocks)", "value": "4a2a3aac466d296025ea419631a24d2f5e3dd023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.Agent", "colour": "#F4A617", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Agentb", "colour": "#7A25B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512226, "uuid": "8560d3f7-b001-4c67-a305-09e9e28fa623", "comment": "Malware payload (GhostSocks)", "value": "c89d3e05dcfafabba11e1bc4252705864a386a1405ad4f60b677ae44ab56d7beda593435f41b94779e4d1510e8869844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.Agent", "colour": "#F4A617", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Agentb", "colour": "#7A25B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512226, "uuid": "fdc0c6df-5539-4cd8-9ac8-ae26a6259144", "value": "T155276B42FDC744FADA475530809B622F77348D058B2ADBCBE6907E3AF8336D25A76205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512226, "uuid": "90dfcc1e-6f78-4b1f-b0a9-63e0b824afd0", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512226, "uuid": "b061fc66-d2e2-458b-96e0-fffba500c3d5", "value": "196608:8oZEEUSilL8D/EXbJcT2b8q+bf2DMPeTErMWEcFmjohn5O:89j9vpbLEwZgxgjohnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764512226, "uuid": "a9c4b345-6b77-4ffa-8d09-ecbfa2fcb071", "value": 20372584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764512226, "uuid": "dbda3aef-b9ef-4986-91e2-87abd048f874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512226, "uuid": "bda1a438-1d8e-43a6-a2db-a5d67735d5c3", "value": "_fm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d3dd7c-ce0c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764521173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764521173, "uuid": "104ce1c5-ef8f-4ccc-b02b-67ceb29f5d3c", "comment": "Malware payload", "value": "34d3e3c4ba1858db062dfec32a0b6bd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764521173, "uuid": "d08b2c74-659c-4363-86a2-176e44908a23", "comment": "Malware payload", "value": "4d9229c8c54cc162dc8cad0e7d2291d7666111c1db75bd640d5180494f53748f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764521173, "uuid": "01c6f631-0c3d-4ea4-8278-ab498237c569", "comment": "Malware payload", "value": "e33ca3445d398cc16624fda5a05ca14b77805132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764521173, "uuid": "30b59372-cfbc-4833-8267-160e7a37d9dc", "comment": "Malware payload", "value": "6ad5633600766ce156f02e51d3189291bc38ff2ecb0919ae246817d2f755d68b01569313d806c1a6d3aa7fecaa55a311", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764521173, "uuid": "e35dae20-f897-4fa7-a92d-b5f5ed95431a", "value": "T146830846B9819F02D5C621FAFB9F415933136FB8E3F97102DD20AF6023869DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764521173, "uuid": "a333f8b2-71a0-4f67-b6de-0fa4a068af98", "value": "1536:ounv4WTUXgMe6Tf9ImHXcVujIFaaK+B31AULXEpZalkI2iWoVqTfwYMu6PJ+x:+WTUXgD6Tf9IGXAujI4az31AU1+oVqTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764521173, "uuid": "27089915-4fe0-4e0d-a308-e3f7f9af8137", "value": 87340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764521173, "uuid": "d77e6b44-680d-4ab1-a43d-f12e4733e6c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764521173, "uuid": "4d98733e-59c3-4aee-8807-c5593fa38ae4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb43e6e-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496758, "uuid": "f25e4169-a41a-4b29-ae44-7a3aaf4e0c00", "comment": "Malware payload (Mirai)", "value": "e281c8a83c2b75553fcafc5ab9b37876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496758, "uuid": "d811d8c6-bf95-4028-bda5-a8081552ffca", "comment": "Malware payload (Mirai)", "value": "4daf6901d058371c738921aaa46a1507c76ad3e741fcb9326dbf81b5181c2b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496758, "uuid": "39a93662-14b2-4a0d-9d99-e3467df040a4", "comment": "Malware payload (Mirai)", "value": "d051556ecac9b8f287ce8f5ba6c3b438abe2d89a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496758, "uuid": "a2c2ff4e-fe58-4d55-aea0-7ceb2c57bc0c", "comment": "Malware payload (Mirai)", "value": "6feea3639b3a9dd679c4d28ef5299664d8385024ed46f163551901b2defe6f1b3219fcf5ab5516250980bfc7369dd19d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496758, "uuid": "18a9287d-a1f6-4c48-8438-dd9be5cfa298", "value": "T1B1F31A42F8418F16C5D211BAFA1D128E37131BB8E3DF7212AD245F607B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496758, "uuid": "1ab0a00c-81c6-4b3e-ac23-d7e34880fd49", "value": "3072:XkGROPfU3yLPrW40QdIA2XSaRuwXOcJvBCRlYOP6hh1zW5:X3RgfU3yLPrWlesXSaIwX6RlYO+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496758, "uuid": "a50f0373-f99e-4d49-ba76-da2195fc9ae1", "value": 170940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496758, "uuid": "892712f5-f376-4b88-b1ed-5e211601524c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496758, "uuid": "0230712c-acb4-4d0e-a992-e584bd3b51d7", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51737f69-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494216, "uuid": "edc7f624-ddd5-463c-a567-41e058d73d43", "comment": "Malware payload (Mirai)", "value": "a975f67ad05e97c314e16d9e0b180413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494216, "uuid": "b9aa1734-67f9-4eaf-8ebc-3ba2a8b69724", "comment": "Malware payload (Mirai)", "value": "4def69bba619604c6bcab7039d01e9cbe69b7b9610cd15333ca8751a8e17f84a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494216, "uuid": "d233d590-cc45-48c6-b74c-b1a3d45a0588", "comment": "Malware payload (Mirai)", "value": "4b580ee8d12ea1ae441ef4c7324926829bc31606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494216, "uuid": "bc272b2f-131c-4613-ad3c-0a8eba7b3540", "comment": "Malware payload (Mirai)", "value": "910d241b964260dc1e862223495da53dd3821a64614eb90a41434cdffec1b7ad77f5968d59be60f2d6afc194fd82feb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494216, "uuid": "0f2922c7-f7b8-4e59-a61e-884770d322ba", "value": "T158D37B73D8256E98C625C5B4B0648F782F43D1A881436FBE69B7C2B05487D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494216, "uuid": "a70eb61a-a736-4747-ba51-72da7b1888c7", "value": "3072:QOuckx3SPfcjjNr/qDhTdDWIZ19K6hh1L7b6:QOucl0jNri9dSIP9d7b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494216, "uuid": "3e08bd9d-653f-4bd3-b905-11c1b140f246", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494216, "uuid": "7c3cac29-5f61-4d63-bf24-1496df6c19d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494216, "uuid": "71c21759-59da-44ff-9af8-aff01df4bc9f", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6280cde-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468186, "uuid": "635a565f-b9ba-4007-9842-28992116f35b", "comment": "Malware payload", "value": "9c38530f23fb865fed7693feaeee28af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468186, "uuid": "90e02f07-a141-4f32-b6ee-0d9996c79083", "comment": "Malware payload", "value": "4dfc23150298b0236500ebaa09bffa740238c3db5597e43c77244e30195f25db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468186, "uuid": "5e82a928-5f20-4a09-adaf-7d2a78f73a54", "comment": "Malware payload", "value": "e61cf8640addd34ce8ebcbccf4c91a59a612d560", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468186, "uuid": "cc666db1-7fbb-4bee-b4d7-8956bd004a6e", "comment": "Malware payload", "value": "a1688232754e332b109f550261cf846945810d9322e5360c245da8a4fdd0d507df99aa591ce9978cf82774f65c419010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468186, "uuid": "5349ff1c-5c83-4a5e-8b81-7bf231af7ea7", "value": "T17C753399E4CF6C626AE7D4EAD389A38147C3FC0AC1ACECE7211267764166B317D250E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468186, "uuid": "fe13f12f-f4e3-4f22-8f25-88780d2f1c85", "value": "49152:VTCNmjK5bBKLIgJtTWWz48F25l2w4rn86qIhx8x5:VTCNjR4Lbz/cn2X8ox8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468186, "uuid": "9717a56e-6990-4f7d-9a79-f3e49aaf86ba", "value": 1632424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468186, "uuid": "6decf98b-50b3-42ee-b615-d7267d0e845d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468186, "uuid": "f868632e-fae1-4047-99a1-32f071583f4a", "value": "bizy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a782069-ce16-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764525558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525558, "uuid": "4ce3169c-bb98-489f-ba88-3627c9eb5fb9", "comment": "Malware payload (ConnectWise)", "value": "9d8b4974715616cc4e4e6143bf6261d7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525558, "uuid": "f0fb63d8-e927-4a32-aa54-9e43fa22a929", "comment": "Malware payload (ConnectWise)", "value": "4ef2e884b6259392c2555b2a33fe2d0721bf7f28cc13228ded18b1afcc9ba98a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525558, "uuid": "b5e59efc-f48e-49e2-be84-2903f968bb0a", "comment": "Malware payload (ConnectWise)", "value": "50fc6877634f6122fe47082cb9652dc8013cf1e8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525558, "uuid": "c64b2a58-f319-4c62-bb25-54bc59b74bf1", "comment": "Malware payload (ConnectWise)", "value": "bbf7aa633eed28684f59e09c41e4a66a3c9e92dd295ccee476bb830393906e8837f2307ef99d501f2c78e0047ed53380", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525558, "uuid": "437982f2-67e5-4d91-80ed-deb755635e34", "value": "T18831146F13082235CAA74758DCA953C7622ED36E0241BCDEA4ACF458FA051A251F7BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525558, "uuid": "90ec86fc-6219-413f-ae85-3850cb7fb289", "value": "48:j96wTa3VR4oBtHp11Y7YP1z2e7Ncyi4rsoSbbqDbEBH:92lRjBt1F2o/iou2DYBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764525558, "uuid": "9eeeebe8-b5d0-490c-a51a-d73753f24262", "value": 1658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764525558, "uuid": "4a4b9d4c-a338-4525-a5bf-6e5368892d62", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525558, "uuid": "711229f9-e5ea-4fe9-ad16-face500eb77e", "value": "file.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7e35c3-ce48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764547038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547038, "uuid": "2569bf7b-4f6f-4743-9aaf-8e0e3c062819", "comment": "Malware payload (Mirai)", "value": "57866e75a4d08647c112df9da1e63895", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547038, "uuid": "c4d07a9c-e254-47c4-bc00-8e32f1f3a97f", "comment": "Malware payload (Mirai)", "value": "4f2a9b0793d39f50e1704db350ce2f5a1e45da662cbbed022424b7d8ec76e109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547038, "uuid": "b0c49f3f-3b98-43d1-b919-cc8c1fa87040", "comment": "Malware payload (Mirai)", "value": "6d881ac3880ff3ceaf02dc5561813adc6c043aa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547038, "uuid": "35c074d4-4c42-43af-a557-e17cbd2027df", "comment": "Malware payload (Mirai)", "value": "df40b6b5f6f17ca9d131f9317672c84e21491a198bf6418878302621599c006b47f795f3d213fbd79b22f9de793702bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547038, "uuid": "75491866-b6aa-460c-a129-8cd05c929a9d", "value": "T1F3A36CC6F643D8F9EC5605343132FB379F72E5BA2129DE83D7A89A627C63601C406A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547038, "uuid": "3040e67c-5e9e-46da-a0c2-075a417b7a9a", "value": "1536:FnbhjFYbf1Ui5hKbc+sxKLb+mX1OEUSr1pAm3Jn5wR54yfZLi/sd:FbhWbT+c+sxK2mlOEUs1Z3vY5Xi/sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547038, "uuid": "fc7555b4-e3cd-49fb-96b8-5eaad93aaa43", "value": 100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547038, "uuid": "337eff4b-3c8c-43d8-99d2-9028278eb8fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547038, "uuid": "db91630c-cf57-495c-9326-56ada03d253a", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6f595b-cdd5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764497649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497649, "uuid": "7deab952-297c-4a95-bda8-384bc853562d", "comment": "Malware payload", "value": "b6f446418235507fda4abf91ee556a1d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497649, "uuid": "9d1f2222-a7ea-41b1-849a-1fde72fa875d", "comment": "Malware payload", "value": "4f4e795555740038904bc6365c58536a660d7f3206ac1a4e89612a9fdf97f6dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497649, "uuid": "e1de0ff6-529a-4057-8f26-431cbe5cd778", "comment": "Malware payload", "value": "c25e659a595d8f61208572d86e0d9bc8d570020c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497649, "uuid": "5ef8a670-f367-4f47-90f8-5eea52d6e6c3", "comment": "Malware payload", "value": "3f6fa4e0ab572b0a165236568f99e3a7a922f5cdf28b1771e4d16049801a44d3fe91966e3a3345d8e6cb16d1a62c0320", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497649, "uuid": "217d0e30-08c8-459f-afd0-e91cfe12c4eb", "value": "T118F0AC5357EE7432EF476EB88E9B36414A6D3589294436312FF00846E0F8D8E4339EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497649, "uuid": "210d5d37-d8fd-4386-94e5-5a18273ecdc7", "value": "12:whjN0NgunPXGRcBAB0QoRZAOK+0QryxXKXsMWBxWb3Riv0Ag7gA:wD0NbmchROOK/QmRK85B+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764497649, "uuid": "80b8a3fa-6e1a-4208-8596-d2480078d580", "value": 634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764497649, "uuid": "17d125d4-8732-48ac-aed9-384df330002a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497649, "uuid": "839b0fab-7112-4f34-921b-12c23f79c693", "value": "4f4e795555740038904bc6365c58536a660d7f3206ac1a4e89612a9fdf97f6dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f452222-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540142, "uuid": "26496cc9-54d9-4c61-8736-2cd0c96ed59d", "comment": "Malware payload (Mirai)", "value": "6d44036571af030fa3fb4caaf4068b91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540142, "uuid": "bbe51e73-26f9-4cdb-a7cf-4b74a7d921dd", "comment": "Malware payload (Mirai)", "value": "4f6dc3b3d26c4d4baae408eef6cd1df8af899860f4756115620aef8e6cc44db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540142, "uuid": "2666e48f-5960-4b37-a64f-e71445cc07ff", "comment": "Malware payload (Mirai)", "value": "0e8577a682f2f65e4b0f5e7e04856f5731a28e3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540142, "uuid": "d31cc8bb-ce27-48f1-94ee-79d2078a60ea", "comment": "Malware payload (Mirai)", "value": "15c40bc1657ecca207bfe616094b54fc29c45f019c1ffc5ea68bda2fa26b77e51b58a7b3e995a30fe4c6d145fa1900ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540142, "uuid": "538391ce-8c9b-4a83-8e07-0c8d2b521540", "value": "T11314D60AAB610FFBDCABDD3706E9170129CC641B22A47B767274D528F54B54B0AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540142, "uuid": "5b673f6a-6f6a-4189-82fb-3d6cad20313f", "value": "1536:ItGvgFzSXFsKeXWtsrr0YHl64UMFUCnBXMW9GCibSasg3+EyUDZ0k61R2xNfWuW4:sGvgF2tC0YFFZn++0DFDfWnITHgMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540142, "uuid": "c6e1a934-e389-4eea-a2e0-66628a367d23", "value": 194204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540142, "uuid": "8f1d294e-a3f3-40b6-997a-5ff7ebb91aac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540142, "uuid": "bbe42d7a-1cec-4ac2-9cbe-c87584670761", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e8d3d7-cd8a-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764465312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764465312, "uuid": "9976a363-ebdd-4faf-9559-17cf770a8a17", "comment": "Malware payload (ValleyRAT)", "value": "3d27331e110ae1180a47028a6563092b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764465312, "uuid": "153ee348-fa0b-4211-bcd7-edc06572009d", "comment": "Malware payload (ValleyRAT)", "value": "50573b4854f35c7cac1ae417a6254310a3aff07e0d8afa093bb2ceb337371587", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764465312, "uuid": "f140d322-1e13-4f85-8e8b-37882ca681e0", "comment": "Malware payload (ValleyRAT)", "value": "7dd69ae9092f406303b7a02d403c5e60c89bb55c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764465312, "uuid": "eb3de6f8-28c0-4723-adb3-a1eae013b98a", "comment": "Malware payload (ValleyRAT)", "value": "c55320f550df2d88a00148602878dcfa86826532711f1de63a5666222e209575fc56f80f830e7e900425a2b03a454382", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764465312, "uuid": "0c4b070b-5b30-4d0d-b890-f32945856351", "value": "T19E836B54B5D0C0B5DABE19360424DAB54B3EB810EED1DDAB3B99066E4F302C1DE31E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764465312, "uuid": "44b01168-c563-468b-a34e-bf5d9316a756", "value": "6fd6842f9e90ee8d70114257197836c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764465312, "uuid": "f5c70b7d-d31f-4557-927b-286ce2b5d668", "value": "1536:hUvHBkSKpy2enE2G9yoCFbZLxv1oeARJsSR9sWrcdb8W5SWq53fXN:hUvHBM38E2qCFb56RJslb8WcD53fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764465312, "uuid": "638b245b-364a-4e00-b9cf-c5ce5d0d0d8b", "value": 81924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764465312, "uuid": "5a5c9644-2236-4618-a320-511752ce564c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764465312, "uuid": "8a72a6fb-efa7-4f74-a008-12dfd7de49f2", "value": "3D27331E110AE1180A47028A6563092B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca714b8-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538795, "uuid": "ad31299c-ab6a-41d6-a8e6-09895b570c1f", "comment": "Malware payload (Mirai)", "value": "bb6b7877665d2c447f3a098b29ee1353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538795, "uuid": "d9376b5f-c547-438a-9338-8a8b9da6c837", "comment": "Malware payload (Mirai)", "value": "5414177980961379afdf434fd132a4135d9b6d87c8c98de3b732d61e9cb1e0ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538795, "uuid": "dc3a21d7-b725-4691-a6ce-28733b44867e", "comment": "Malware payload (Mirai)", "value": "21854d0d60453f207ab048331cbdfdda8e3ba2a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538795, "uuid": "034005a4-5626-4e96-86ea-f8811b121c36", "comment": "Malware payload (Mirai)", "value": "3694aae093e9ec1d7a476504e2ffa451a88e35b3621b1a679bf545993aafb5576ebbe4a51d785c967777c8c24e2f819c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538795, "uuid": "a4c33c08-1497-4e2b-960e-2c583a1ca872", "value": "T1C3E34D99F402DD7EFC0BE5BE44670E15F930A3A13143172E529BFDA3AC321961D26E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538795, "uuid": "7d5023cb-9e45-4e42-a05a-471929e237ba", "value": "3072:RmmyBVk2SJgv+pkkSxUcCl10cvjvF9JrT7vybhn:8S2SJgWaUctIvF9Fabhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538795, "uuid": "27b4f0b6-6c0d-4291-9145-cff151c1d809", "value": 146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538795, "uuid": "83d65813-2e06-4ecb-a28b-0060fac7781d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538795, "uuid": "2304ce93-a8ca-42b8-809a-3b6e90950237", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5568899f-ce21-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764530301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530301, "uuid": "e50dc4d1-e722-4376-a8ce-a5dc477cf808", "comment": "Malware payload", "value": "acaf7a5e017582c16a7bd5cb298ae46a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530301, "uuid": "cab938b4-fba3-4942-8138-77c7145c284c", "comment": "Malware payload", "value": "545495a1f3e25e79c3bf8a53a6aa86b2eeb337335e7a528dba9378d23bedd4ac", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530301, "uuid": "42f934f0-045c-4e02-9459-98e9efa4a649", "comment": "Malware payload", "value": "36fab9563f3104de623bd86544a2c5bcda12cba6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530301, "uuid": "4d7e2677-9b07-4cd0-aac3-14788af94f9e", "comment": "Malware payload", "value": "e8346aeee637496023b7dbe2a2e5a61280f64b22054d2c3463a26023e60e54b64c8c9fc51860711601450af5b4b0f722", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530301, "uuid": "2e90c822-7c76-42ad-8366-122b05cf966f", "value": "T1BD265D139C51CE7AD8AA9239B9D320C9A665BC8C4F3537D39A512D351E3E3CC08B7B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530301, "uuid": "1445c80a-c32d-4fe7-be27-0efc0fce0951", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530301, "uuid": "af383124-5b67-4a64-9740-fc68b354f6b5", "value": "49152:dGQAT7PYoB9iVA42CSiVz7tVz+j3MPrv+nSiB2zWCSWJDEOVKcpW6S5VrM:dvST4CNSiBgJDEOVKcp4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530301, "uuid": "6e98949b-c8c7-4ee2-9945-73d5606c20f0", "value": 4834944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530301, "uuid": "3aec0b91-5563-49fb-86b8-d4c4aaa09c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530301, "uuid": "066820e7-8e1e-4455-a510-76365f698c21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51f5289-ce42-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764544742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544742, "uuid": "85a7df56-4163-4682-81f6-5b033efeae3d", "comment": "Malware payload", "value": "659c2a6b612df18094e197e5f3a40471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544742, "uuid": "c8734696-633c-4bf8-9175-e6c7d4049667", "comment": "Malware payload", "value": "548aad5f97c677a90ea402369fda93eb3f94ac3d267708f3c0cb767d560e2401", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544742, "uuid": "9c819ead-e747-4d50-9e60-3a9ab2c4c64e", "comment": "Malware payload", "value": "1033d7509a4f1482fdc254fbc5c8310f3d9ecb33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544742, "uuid": "fb2de984-66a9-410b-ae24-999628ee7a58", "comment": "Malware payload", "value": "52b43d90979900c9032497414aff1f7a561cfc9dad2732c313a2848340ef70ccd3769f9dd047a32dd1d52a8b2150f632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544742, "uuid": "9e0b5030-0ad5-4b26-b7df-4039b4ba10dc", "value": "T159434D4273180A53D5625AB0393F27E083FEAD9021F0B689655FAB5A86B5E332046FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544742, "uuid": "c112dba8-f46b-4b3b-b19e-a94c956c10d5", "value": "768:Ly7rmJOHVRievUKE1m1e9g0BueAT5L3N/oclAZABBGD2KiFuT:MrmGAY1edBnAT5lLAyPGipuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544742, "uuid": "3fe24e93-b424-4a5b-a030-ffa29a02f588", "value": 56032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544742, "uuid": "ef28153a-215b-4b19-81fb-37555968e7b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544742, "uuid": "528e8539-9765-467b-ac53-9d6411d6526e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5389a40d-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494220, "uuid": "5ecef691-e2ca-4c48-b6fe-47f9e896123f", "comment": "Malware payload (Mirai)", "value": "c389f033846f8ed905e87df789c38710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494220, "uuid": "474a3ff4-3d45-4f38-a5aa-06d6ab62576f", "comment": "Malware payload (Mirai)", "value": "55060b3fbff6963be8b700de47bbf18a3f1f3de35630cf9e203e4a0d5198eb7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494220, "uuid": "fd5f3e42-77ad-4573-ab5b-4a1d7be86675", "comment": "Malware payload (Mirai)", "value": "bab425c2b220c7314979d0a01d70201d35741611", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494220, "uuid": "38416c32-e91d-4f2c-96e4-6743f0a20c48", "comment": "Malware payload (Mirai)", "value": "c3be90c9f0781a0bee7289e26506dc5e544a9da84763d4c62a2d89a8ca50dabdf43b3e454ba202de935cfd0bf3f14e38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494220, "uuid": "0b9b4863-57d8-4e2c-9139-1e4df0ca41ef", "value": "T143430274A31205E1ED141A300B67478D235E0FBA42877D61A15FEBAB9D1A1FEDD03EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494220, "uuid": "0bd9ad9c-11c8-4ce4-a76c-3da707961f2a", "value": "1536:s4kKad2CGj1NUqIpaBotfHathOWSQEbRVJuK:xyqxt5B77CRVQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494220, "uuid": "24114aee-7773-43fb-b0e6-361990031230", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494220, "uuid": "bb8c4351-390a-4a99-9665-a0478a1846dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494220, "uuid": "672ec260-dd95-4264-ab09-ec754dc9dc57", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad5ee0a-cda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475495, "uuid": "4c19f25e-7046-44e6-8051-a2fc1b463bef", "comment": "Malware payload (Mirai)", "value": "69c7e0ca16747711eae2cd2d5be74bc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475495, "uuid": "b0d2dfce-2e49-456c-813c-e25a3f3f2257", "comment": "Malware payload (Mirai)", "value": "55e6dbeac617b1ad7eca6a277e78848fcce81442cf948953a3c6438d90df4bb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475495, "uuid": "957bc5de-3d07-4a27-930e-c855d4c142f0", "comment": "Malware payload (Mirai)", "value": "3c5b72e375efe652c061e84656b17492ffada0b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475495, "uuid": "f79b2ec4-45dd-4908-b327-34a499a03028", "comment": "Malware payload (Mirai)", "value": "5f41d42d9e0c994219e25b27a6e7a15009fbba9b0766d2b5d4fa89ca4ff8feccfa6c584c3f23c00f6eac8b68460dcdff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475495, "uuid": "49e125ba-4001-4504-843f-709bd2d6cc12", "value": "T119436D42321C4A57D55659B0293F57E083BFAA6020E0B7CAB40FAB6E4675F33508AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475495, "uuid": "41c1da25-805e-43e2-b51f-de1f35c4a8c0", "value": "768:mZwhqlivD9RAPIfqJ7hwfQjs2xBlH3BdGSA6c+f1eHYGjiKqgug7R8:zhqKx29hZdxLHRcRefo4GGcug7R8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475495, "uuid": "b51823e4-c2aa-4add-b0ca-0d432ad1e2a7", "value": 59752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475495, "uuid": "9b87b4f2-704b-44d4-bfdd-d30734add5af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475495, "uuid": "add9d2e0-4af6-45e3-a1db-3cfe7f6a1350", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f52de1-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540230, "uuid": "20e7dd22-ee51-48f1-8525-f4d6e116c3d2", "comment": "Malware payload (Mirai)", "value": "53986c87b890de9f197b63b5aeb6fa83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540230, "uuid": "5df21b1a-868c-45e8-aafb-a19d2277a15b", "comment": "Malware payload (Mirai)", "value": "55f73a92637fbf0e14f292ff7accfaef1cab07ca0875829c78e24df41eddae16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540230, "uuid": "8310fbe7-bd56-48d4-8cfa-b12451750f06", "comment": "Malware payload (Mirai)", "value": "c78e7c3bbd5adc8a03e4c8f2d21146fb39ac42d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540230, "uuid": "179d829f-9c3c-44cd-9e0d-26d81ba9e2bf", "comment": "Malware payload (Mirai)", "value": "bbb3f4b7716d46d04d4f916c32c3e55a9da882e8de8fbb2c1aa454ab6fd102689bfd38b3b24c7fc372d18dcead752d5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540230, "uuid": "7987a26c-5841-40f9-ab86-b1c3a0fa8609", "value": "T14E431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540230, "uuid": "96f4b3a8-bb5d-4cde-b51f-3f392a8ea314", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540230, "uuid": "31902a00-8732-4849-ae8a-4ce0bec4e53f", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540230, "uuid": "dcf6acca-378c-4a8f-879a-a3de32be9592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540230, "uuid": "2ecac7c1-0ab8-4fe8-9107-ea8a02577772", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20473668-cdb2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764482537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482537, "uuid": "d57d68eb-3ef2-417f-8e35-22c9ec96ef59", "comment": "Malware payload (Mirai)", "value": "c2125d5f1f01870cf4bdbff5d89841bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482537, "uuid": "40b085a1-dc87-4f2c-9e43-e345002b8695", "comment": "Malware payload (Mirai)", "value": "5606be15fca02f519a622de48f50ef5b64ac495300d78e2f96204fe83aee650d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482537, "uuid": "e812afb3-cda7-4c3b-addf-02ac21fc784c", "comment": "Malware payload (Mirai)", "value": "e8f11e14f04a948f584f61c1456a15415b6e457b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482537, "uuid": "07941e69-140d-4911-b57c-4728af5a3d3c", "comment": "Malware payload (Mirai)", "value": "966e22200f88a32ac112ebf58e28336c3b003dcf7d4bf6572a8851ae7f5fe1c3ffd3a4b4df3b0b4d7ca087f84f7a1de3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482537, "uuid": "ce267a53-a060-432d-a28c-fc843ce8ad0d", "value": "T19E24C606BB611EFBDCABCD3746E9170128CC540A22A93F367674DA28F50B65F4AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482537, "uuid": "d5c94d59-0014-414b-b913-66f29c24b4ff", "value": "3072:7hbrNE/b7iu1VqQM+K90awQ05YHU+QJ99AP:F4ikAQM/4cJw99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764482537, "uuid": "493a629e-ab14-4b37-a349-8a558711a7f7", "value": 227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764482537, "uuid": "6989b943-2f0e-4083-ac27-f10453639582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482537, "uuid": "8a2bc7c5-40e8-4583-aee9-13d71c618641", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8a389c-ce3a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764541181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541181, "uuid": "ad36bd73-23f9-4032-b0f4-8fcde7ae8bcf", "comment": "Malware payload (AsyncRAT)", "value": "202523455a0304032abf136acf51d250", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541181, "uuid": "5dd97dc0-6308-4562-bf99-d4c9fcaa9673", "comment": "Malware payload (AsyncRAT)", "value": "565233cc8e4de34e543ed83307c22a381888cb10ce1c0e8059def7f55aa0df9d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541181, "uuid": "40e6a7a8-322e-4bba-ac75-2ca072c1503d", "comment": "Malware payload (AsyncRAT)", "value": "080caa24645b6e9b36d0f16738669db20afb9277", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541181, "uuid": "b2633a30-0c8a-41ce-b9a7-55784259f245", "comment": "Malware payload (AsyncRAT)", "value": "4e00cf124911ba714891a4bbf631e5894ed067bdfe20bb3bfaeafeda1a1479d5252a422f45f5695498805553e7c0d9b8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541181, "uuid": "0f084769-3b85-4b6e-a113-b691bddc4a16", "value": "T13B411E39B2D69B1012601D60A43AEC8153A9E9DBCEF60857F5E991C64EB9308CEE45E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541181, "uuid": "bfd924ee-ef83-4b0b-8ae6-8f1c1bb8a4ca", "value": "48:X4DY777x/rhA9Steiu5gXdm4jc5lVfkQoE96A0dXAst7ait7tmz:X4DPSteiu5gXgbjkQoE9CNvzRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764541181, "uuid": "8923adce-f996-4a61-a149-324cb649af4a", "value": 2436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764541181, "uuid": "dec21f0c-2a5e-4d5c-9ab8-85c66201166e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541181, "uuid": "8c37eaf9-3d4f-4123-9d57-6328bbb80fa2", "value": "AutoFarmer.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70330b10-cdc0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mettle)", "timestamp": 1764488684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764488684, "uuid": "63541919-73b3-415e-95e8-8c4c39e302e2", "comment": "Malware payload (Mettle)", "value": "1ef14bfe10d610c2de694a284ee1a4f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764488684, "uuid": "63fb985b-69bd-4e1b-a103-fc81a254eaac", "comment": "Malware payload (Mettle)", "value": "56f478973b3931c04dbfc080042b545c8067ab23d8796b400afde1da5c336570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764488684, "uuid": "d6fa8511-4a31-41ff-9c84-bf80acd64a76", "comment": "Malware payload (Mettle)", "value": "861b9b46fc1fc44c6722b2e0b93929b40c647f0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764488684, "uuid": "9bd65e75-5f6c-4864-9e20-f61b19bb9436", "comment": "Malware payload (Mettle)", "value": "3abdd7e362e8a1c1dfa4a3786f49b4ec369ef8beac3d994653f74ece97f7a5a0d00c097faf83314950c6aaee9aba702a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764488684, "uuid": "87ffd106-78f6-47f1-ae44-56ae02d38f85", "value": "T1D4357E0BAA9504BEC5F5C470875FC233AF71B4896212367B2694EA303E67E346F1F691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764488684, "uuid": "8acd5bce-aeb7-49ac-82f6-dc6d0c434d97", "value": "24576:kxW5r2UZu6+QO7UAlBKsBWrTPgE0hi/djV:75r2UZd6UAlB70TYiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764488684, "uuid": "4d675400-b3fd-4f09-9c2c-d66573b633b6", "value": 1121480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764488684, "uuid": "e41c937c-797f-47a6-84b3-b252a46d4d35", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764488684, "uuid": "d497fc83-fcd7-471b-b83e-212f7b4c7288", "value": "meter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02bb100-ce17-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764526158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764526158, "uuid": "5b90d239-8e01-4efd-a071-4b16907a8402", "comment": "Malware payload", "value": "f3d1c4cb0a073fa5ecb330a954dd197b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764526158, "uuid": "f7cccee3-94e9-4e15-b121-ff8ca9c69f09", "comment": "Malware payload", "value": "57215189c88db40bab56ef7e4f0e180fb7e7667bf4d4d486622fd3f7e11f02f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764526158, "uuid": "02ff7945-5026-4b2d-b523-4aa998ad287c", "comment": "Malware payload", "value": "9776d2b0688fc042d586ab8ada528485ebe1b580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764526158, "uuid": "05b01966-51e3-4492-ab5a-685091ee3b51", "comment": "Malware payload", "value": "d44ece07fb2e3b414c8599e5c53714e4db036d09e5bbdb037638208cd41e27718ffb3b37e0b3f3f2be77097aea67a162", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764526158, "uuid": "81b3b6ea-938a-46be-83f1-a1c906864cbd", "value": "T1ECE3180779C18EFFC49BD1F44BEAA5369A32F82D0935714B7794BEA11F5CEA02A1C610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764526158, "uuid": "e3d0a66f-c370-4d1e-9205-c93a709c81cd", "value": "3072:gEE3KI9OLUDnTubYuHhQnaJlfd01IQn9Hex1ONPtB3E:gAsOLxmajwdow8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764526158, "uuid": "f9f359ac-f699-4335-be67-4e4c76e4fb64", "value": 144200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764526158, "uuid": "1bf16e74-f26b-4999-9d6f-85206484cca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764526158, "uuid": "004c9474-1db0-4f06-b3d8-5e6b9a2dcd88", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d98e1db-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540139, "uuid": "a0f4b71b-afd6-4e38-9726-c74a3f288b44", "comment": "Malware payload (Mirai)", "value": "96404f84432a27d2789df3c2ed311e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540139, "uuid": "9ed9cd06-169a-40d1-8369-3e0a240419dc", "comment": "Malware payload (Mirai)", "value": "57819069690760de2ae832d0fc30df5fe9e2d9af4367fc720dba9de0f83d710e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540139, "uuid": "be4fda44-8baf-4b42-b6d5-8a074214931a", "comment": "Malware payload (Mirai)", "value": "2f7c76cbaebfc38d650d91a6b983446bdc82e0ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540139, "uuid": "33749653-856e-4058-831d-5e5d149cb3a8", "comment": "Malware payload (Mirai)", "value": "e5e5ab3d1cb365b1d1755d81e6f7b9dc45069aa6ae2c8edcac51ab008fbd42a0b94a74d0c1bf8c846b3ad4c705a0eed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540139, "uuid": "6b5366d0-12c0-491b-a0ce-f3b0cb5fba12", "value": "T1FC82D03061AB71E4DBF14431FAEECECA571A0BF8D1FC369216586F78CA4210651F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540139, "uuid": "c4974b68-ef62-4b45-b473-15802bfbbe54", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMahJhymdGUop5h5lJ:6GV0P6+kom0tVAoNvm+to1Ls3UoznlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540139, "uuid": "9801c819-cb84-487b-95b8-9308de1d59e1", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540139, "uuid": "2134b1d4-2776-4044-a06f-a53b7d88b6ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540139, "uuid": "d914550c-cdd0-4d73-8ba4-002a35399d4b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d8e332-ce27-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764532747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532747, "uuid": "3679039f-0311-495b-b1c7-2bae075afacb", "comment": "Malware payload", "value": "4ad62ec6712c6e925f33103e7dce029d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532747, "uuid": "865cc531-1e62-4a14-8e67-99008b8445a1", "comment": "Malware payload", "value": "582aba94de792b8dd4dc63c428c5995be8d461b048deec9500e77ebebfd156dd", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532747, "uuid": "6fd04b31-95f4-4bb5-9fb0-e8b7785a435e", "comment": "Malware payload", "value": "c53eda23962a6ece67c1b14a3e8c08ad0597ef09", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532747, "uuid": "ab56084c-9979-4220-94df-998276a07470", "comment": "Malware payload", "value": "5d0650704c67322a256824c2a0d725a480f5941587c6f623d460fc82ea895f10316e113f0dfe5bc4fc9af669561a2587", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532747, "uuid": "bfd39420-0b21-4065-bfa8-119632be93ad", "value": "T16084682DEE42F124EE1D06742B6599EC375ECCE84238694AD3A4B829357E7431C2F34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532747, "uuid": "18f9ba86-10e8-454a-a82a-b8edec9f84d4", "value": "11f4b2e2aadfb6e5398b680c8508f0ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532747, "uuid": "4ef0b41b-8754-4b40-97ab-b5e537927ceb", "value": "6144:jkbkpYrRSFfkcjpDIdeWtxEfIsuNjmPv8HAKzp11ooXac:g7l4RaHQfkrAMp7o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532747, "uuid": "2ada8ebe-e0d5-4c21-a695-b75019991044", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532747, "uuid": "5138a044-4f7e-443d-9372-c76dc7bf5b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532747, "uuid": "2529abb2-3381-409e-904b-5fba7a5398a6", "value": "\u6700\u65b0\u5ba2\u6237\u4fe1\u606f.YR6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114f9b36-ce44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764545219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545219, "uuid": "b79277f1-ae5a-4601-8810-b107ac9062ff", "comment": "Malware payload (Mirai)", "value": "53b71e249f7feef8b8abfe4ca2803595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545219, "uuid": "867f2acd-322d-4768-9e55-a9db0f1d3603", "comment": "Malware payload (Mirai)", "value": "586797fc70c9dd5ec905ea7748a4cf50328096590c44555870feda177887ceb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545219, "uuid": "55377455-1ecf-499b-846c-5024ee42be90", "comment": "Malware payload (Mirai)", "value": "901deee60cbe11f9911c942286846ba66f4af8c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545219, "uuid": "0994e715-e29c-4ea5-ace2-156fe2d1d7d1", "comment": "Malware payload (Mirai)", "value": "faa22a79b61d8308a5fcccbbbbd644011bc9c22dbbaec9464725c72d15567657fd852bcccb5cb2f235df8a0c55f15d49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545219, "uuid": "bc8f53ff-7bae-4d25-8fb0-e23e10b2b86e", "value": "T1CBE36C9AF4029E7DFC4BD5BE44270E19F930A3A17243172A529BFDA3BC321954D16EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545219, "uuid": "03488a8e-39a5-44bd-b765-9676180dba0c", "value": "3072:4NnyILV9mTYKBHZa5cVg8lv+mmJ36937ySTEAK:u3mTYOHLgbx369fTEAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764545219, "uuid": "9b5731c9-72b1-4040-822f-c03d8e51f2e3", "value": 146448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764545219, "uuid": "3ce508b3-512c-492b-b9b2-f10993dd7223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545219, "uuid": "ff83bb99-e37f-41e5-8b96-80624b6fbc6c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24bfde9-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468179, "uuid": "4d8e45e1-aeb9-4837-b2c1-9552987588c7", "comment": "Malware payload (Mirai)", "value": "c691f6fdbe308ad679e59347c266f479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468179, "uuid": "639e1331-c4cd-41c8-bbca-c7df29d64e3b", "comment": "Malware payload (Mirai)", "value": "5a7827d9681297873e4fbc739522260acd2734824add84af2744248acf661a60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468179, "uuid": "7d4283c6-b158-42f6-90a7-32dc0d8c9607", "comment": "Malware payload (Mirai)", "value": "b4753f704c7dff4dde53fb84329579524df232cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468179, "uuid": "e4511f46-4e4b-41dd-bc34-ce857be309b1", "comment": "Malware payload (Mirai)", "value": "b2b3a2c45a7c6dcce59e6c794e4a6c2b11428c642221c7611ba0a1ce3d92f5e07ff25b972cfc328d75cbaebdf95ee5dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468179, "uuid": "aab8da76-8a30-4a29-8b77-3c505d2be5dc", "value": "T15DF3991E6E228F6DF668873147B74E25AB6823D627E1D640D1ACC2105F2039E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468179, "uuid": "23d24be3-d325-4077-9c20-3ee22325a0b9", "value": "3072:8f46IO9Uh1vcoA6ykRd7b6qKTdBQAYAN7u0K:8fhJUV1RJUTMAYs7u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468179, "uuid": "04564180-a4c3-49de-a5ff-962db4c31d58", "value": 169356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468179, "uuid": "3fe2aa67-9620-4172-a5c7-4899cd6f6a11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468179, "uuid": "138866fc-886b-4afc-8379-095a6b08e3e7", "value": "odin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9663e97-cdc1-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764489263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489263, "uuid": "9f44be74-5be1-425b-83a8-efff786b57f5", "comment": "Malware payload (AsyncRAT)", "value": "04387c900c2791835e8d896c0c993c50", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489263, "uuid": "e0e71704-4a5d-4a8c-9368-ec03ac80f059", "comment": "Malware payload (AsyncRAT)", "value": "5b3cb89cf9d208f77139e62fb78daf1a510fcd0a2a385d914fd8dc63dca5e405", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489263, "uuid": "95172961-284b-46c9-8d0a-01fe2872fd6c", "comment": "Malware payload (AsyncRAT)", "value": "be5df558f5bbabcf95c80a90a51f02daa872b673", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489263, "uuid": "9dab61b0-ed3b-4e32-845e-c944a74f73d8", "comment": "Malware payload (AsyncRAT)", "value": "7a08856718c639312292bff3cb54b09d1bad86e9af2a1d10e930982d7192a9e0727add280def8fcaf127b6db7b764f05", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489263, "uuid": "5ee4d947-3966-44c8-8195-195fd6952028", "value": "T146034C493BD04625D6EEBFF968B3A2060B70F5139913DB8E0CD8495A2B37BC48A047D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489263, "uuid": "f03e63c2-3409-4666-bd7f-f1d5b98c8218", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489263, "uuid": "7af5479d-7bf0-43f8-a18e-3261211fab14", "value": "768:DPERNgs7Mr5oyty4xD2MEkxc6/F5P99jKt6SOMhl33M:4jAr5xt19mkeYFX9+t6SOMbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764489263, "uuid": "a47d8044-e91e-4002-a3b9-26fee047f6fe", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764489263, "uuid": "3c7a4d4d-3019-4e8d-833a-4390b86bfc03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489263, "uuid": "16975f0b-4b64-496d-8a18-753b011e3cec", "value": "11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d1c146-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540124, "uuid": "b8f04aec-6bd4-43e7-b505-4fe46509e0c3", "comment": "Malware payload (Mirai)", "value": "952fc675cad13cdc4f2381110a0fc600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540124, "uuid": "ff60e35a-6e45-46fb-94da-141b685a5424", "comment": "Malware payload (Mirai)", "value": "5bc7b5b2fdaaca32ac56ae941dde9a78489fa401b1b21db24e0429bef033d56c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540124, "uuid": "13ead087-7ab9-4526-9ff7-c0893931bab7", "comment": "Malware payload (Mirai)", "value": "aeb26e5e86a2de913ef837b50ea3ae61fae32594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540124, "uuid": "f134a235-c211-4f1b-b723-c60f184fb32a", "comment": "Malware payload (Mirai)", "value": "21b362db904ba36eeef5e5c4c761a7801eda9ed3b8aeabfefeb2191ca5e8402476eb129480e36f139b29f2ecdf4d26fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540124, "uuid": "83dc6b4a-2607-4d81-902f-59eb67f46ebc", "value": "T1DB03F751B8828A77C2E0237AB6AE5A8D372177ECD2CF72179D614B207AC551F0D63F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540124, "uuid": "aea391bf-2996-4891-a86c-fd648e109848", "value": "768:kgrwP3DbfkG5FCODn1Vcne/1rG5wn5X9vpK/spRb/zvR4i/NTwW:kyKbsG5FT1VceNDXAEpRf2iWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540124, "uuid": "5161f7f9-5c91-4f1a-b30a-b79f3272a125", "value": 39268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540124, "uuid": "f45e6778-9c7e-4ed7-af4d-e3afb4901a7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540124, "uuid": "05ed51a5-ba47-4bc6-a85a-5a50fdf0c756", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14af891-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1764530857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530857, "uuid": "4ebda8dc-81ac-40d5-b76c-e006fc514717", "comment": "Malware payload (CobaltStrike)", "value": "a07d7d0d82743d75afbe69c2dacfd61d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530857, "uuid": "6cdb5d9d-1ee2-4902-a6a4-1373b9e466ec", "comment": "Malware payload (CobaltStrike)", "value": "5bcef00c270c39cbe34fab65226ca6e442e99dc4e0d42e6a5c1039c105ffa95f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530857, "uuid": "49cd1406-738d-4c98-99dc-556af28f07aa", "comment": "Malware payload (CobaltStrike)", "value": "c67b61b2b092ec26503f3b4869e2ccf9f2f6fa94", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530857, "uuid": "995791a3-8f62-4e90-a898-a24b75472b6f", "comment": "Malware payload (CobaltStrike)", "value": "b0b42c69faa33a5b54044857d10868ac0b2fdce1b5c5806dd131ef9f2ac0b2ec54abf25324185ce015739848ac8edfab", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530857, "uuid": "38e5ede7-b6ec-4f16-ac2e-a6d5e390c27d", "value": "T1B3423941FA8A0DE6E73443F280370A25F5F6BF25136246DF0B3872162EB52D265726CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530857, "uuid": "0cefbdfc-df65-40f5-a947-37ada35c6f5a", "value": "2fc884c7d3280fcd62bbb718bdb13a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530857, "uuid": "181ee832-4d48-4514-865d-862b567aac60", "value": "192:KaDnx6sviRuBj0WcSSanjkmSnBCfhovWywiBi3Q5tfL3Ijc:N7x/veuBjiajqnBCwBi3OWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530857, "uuid": "1477aea4-47e3-47ca-86e6-66e6d1fe00d4", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530857, "uuid": "31742f00-1401-4769-886a-3a5f320d69b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530857, "uuid": "32554298-2040-4531-a1ca-23c11935a0f8", "value": "tufaqixiang2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fc9ded-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764490358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490358, "uuid": "451ed920-aca7-4560-ac63-c9827cb11443", "comment": "Malware payload (Vidar)", "value": "4f4b54718385c350cd8aa5c222475c9c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490358, "uuid": "a197f6ff-d979-4df7-83ed-bcb18e3bb26e", "comment": "Malware payload (Vidar)", "value": "5c7b9621aaec04698b0069e2f8226fc181fc432d40e93bd6c3a5f09520aa626d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490358, "uuid": "a5137f52-a990-4685-b3db-077861da8afa", "comment": "Malware payload (Vidar)", "value": "23832326714adeb5699e0210871c85eca960128b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490358, "uuid": "03f37b32-3ae4-4b47-8d73-e3b73e80219d", "comment": "Malware payload (Vidar)", "value": "007ceace9d64cf82aa8d9548c666e400ebcfc91b78518d3873da45b5bf37822a69111ebe51c7af56c866ff9f8013641b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490358, "uuid": "2ef284c4-a33e-429c-b45e-0c26fd3b7bc5", "value": "T1DDF59E2DAFC0CAA9E29DD139C8E22294BEB83879073713C3692557361F3E3D05975B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490358, "uuid": "26635b82-6050-4e17-b58f-e1438ae0eb41", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490358, "uuid": "9f56813a-7ee7-48b1-a1c7-29471c7194c9", "value": "49152:SD/rEquSsS7SMsW7TZEs0YT2yIQL7/9pcRw6BN3yXEBfuc1+pWCVXDwVRx:SN7i6Kx/c7r62XjaCAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490358, "uuid": "7c9e3a81-e032-47df-9b7d-398c72b98a8e", "value": 3542144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490358, "uuid": "00406e46-6386-4781-be5b-09c54a3bac59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490358, "uuid": "2f3d8cd5-f909-40f2-b469-97c7591fcf33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5ff657-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468221, "uuid": "220a427d-3fef-468c-8bfb-4b77f0f6bd72", "comment": "Malware payload", "value": "2c084c55c4aee80da160b624a2f6b01b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468221, "uuid": "e774eea9-ce37-4ffe-9c78-a57285eb11b1", "comment": "Malware payload", "value": "5da5ba29de35e50e3592af6ab79bb4e49a6be3b3abdec2dcf8a6f7a1addecaf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468221, "uuid": "d5a615ad-97cb-4190-999c-dad88215ee2f", "comment": "Malware payload", "value": "3d69a11cc1077bcc544472abb15f7364edb7ccce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468221, "uuid": "4fb0149d-82bc-4294-b673-85ad0476df41", "comment": "Malware payload", "value": "0a8f925c4fba533864c11a8de42509a54710e6d4ef2c7842d889e40340d19b4cef40f3bb242aa07fa611cd21bc7b7ea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468221, "uuid": "5fc9d1a0-aa28-4ef3-afc3-cf63a5ee7a39", "value": "T1B926E919AD843BA6C41C8B7594EACD9122B06D140BF1473A76A4FBEDBC762347F0789C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468221, "uuid": "69007332-28fc-4961-bc04-f8eaaf4299e4", "value": "24576:rz/zjhymabBUSQDiZUGcn5SB4DD01a1ppvJtd4+4Bmfy/Lh7ltCs+Flgt9VW5kK5:n/zkHIk/B+y/dZINPCVVsepd6315EM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468221, "uuid": "cc71ff60-48dd-4acc-bd93-09823a0ef413", "value": 4587735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468221, "uuid": "e72ccc5b-abf3-456f-a4cb-ad865633f0c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468221, "uuid": "72b1410c-dfbb-43f7-8b95-9609818bd8ca", "value": "bizy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a5c09e-cdef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764509091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509091, "uuid": "805b01d0-f4b8-4f3f-8bd2-988270c8b4a3", "comment": "Malware payload", "value": "a2be229abd55f4ada9d35684bc2b99a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509091, "uuid": "25438d5e-c597-47ac-acac-144dba2002b9", "comment": "Malware payload", "value": "5daece4ebb9440fd7f340d4eaa6ffdb42cb5ec1e9fdb3f6320e01b3786779c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509091, "uuid": "44cbb82c-e0cc-4f0d-af8a-4f41333991e5", "comment": "Malware payload", "value": "e69aed956708d62243ef74b6ffbd2932248ebada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509091, "uuid": "17479543-f6de-47a9-bc89-4c8fdcbfa474", "comment": "Malware payload", "value": "b2216a2c1ec2586715d2d22f09d1d6d11419d73458571b4d190bb42d44b8fef0787ff2fea526f57475a905a919bb469f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509091, "uuid": "84b1a6fd-2470-4501-baed-5b0c8996686d", "value": "T117757D2173E8552BD1BF0B74E0B14449CB71FA06AB17EB8F5E846BAC1E537818D123A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509091, "uuid": "914bf8b6-8a65-47ad-9265-b729b8a16409", "value": "bb3ac2c21e02c68abcad237dc3fa6d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509091, "uuid": "02a152ec-9b8a-4578-bb27-248411de43dc", "value": "24576:UhlqCVKtVWYFWwhYFMCJZOsdqGCdXkOJxP0qW+FutZbJcMFumJIUX/:D2KtsYTHCJZtqJdXkOJP8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764509091, "uuid": "c86ad25d-5d05-41a5-af1c-fc94a9b2eeca", "value": 1698443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764509091, "uuid": "069b50ab-aed8-4769-8271-a954f6bde3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509091, "uuid": "e11f175a-6a7b-47c3-b867-7217739dec25", "value": "solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec26cfdb-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764490610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490610, "uuid": "1f04c4f8-d838-4949-8e84-cf11f48cd11b", "comment": "Malware payload (Mirai)", "value": "9918da150903d37f1a56868df401cd20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490610, "uuid": "5a59b36d-cefb-418e-b31a-81b2eecf2734", "comment": "Malware payload (Mirai)", "value": "5e26ef5024c533d383fc0aa710fb12f86e0170827babfe39813ccfa4b738b43d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490610, "uuid": "e447f8f6-266b-4956-88a2-b9176d9bc87a", "comment": "Malware payload (Mirai)", "value": "a40fa2a6d74cdf983874109a732b56bfcfcf9ef5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490610, "uuid": "c0b8244a-006f-4ac9-914b-19b62925b64e", "comment": "Malware payload (Mirai)", "value": "5db584d2f06fabc32168151b18017ddb12356947549188283f724c255ed2827f756ed59a86c4e5374db930814da1f698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490610, "uuid": "496a39fd-12b1-4b08-9a99-c7c474ec81a0", "value": "T1DAA2D031B5DEDDA4E0702AB49A7A8988762675B1E1FC38E1EC3057143BE210F25B42DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490610, "uuid": "d9aadab2-c19b-4bae-a1f1-98866144e639", "value": "384:FsdCqc/pM+tVIcZ4Sd/wdq9+7d+PcBN0/+Nf/6+ZNhymdGUop5htK:Fsd/c/pHs9SJPk7d+QG/+5ps3UozrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490610, "uuid": "2272ceb9-f773-4a23-929d-8c959e2764d6", "value": 21664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490610, "uuid": "6721c9c9-0d22-4bca-9911-f365d4432b64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490610, "uuid": "1fc71330-cd01-48e2-860a-173129cbddc7", "value": ".SarmUNO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d352309a-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468235, "uuid": "2a2e8eee-4193-4e53-b4e6-11c36a947ae5", "comment": "Malware payload", "value": "14af3b12d4e5500e2647c57a6899951f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468235, "uuid": "bbc4268c-3545-4b00-aaeb-9b571c3688f5", "comment": "Malware payload", "value": "600950a659b260d16f3b1f31daf2cfbd6b2e5c4721a6c18caf8d8ac62f5cd318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468235, "uuid": "91c08f01-dd7f-4f8a-af09-bec553c03306", "comment": "Malware payload", "value": "c6fd5973dd5ae860e68b664cb8af67365bcf88b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468235, "uuid": "aea1431c-a5a3-4529-b1b1-e12aeeed5ebe", "comment": "Malware payload", "value": "618e5810d3ab7c7eb800e0d00b7cae0de52bd2455e2763d6a523c02daa47885a21f1065113775863667054e2ba6cf366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468235, "uuid": "7860598a-4b7d-44ff-84ee-213db9cefa27", "value": "T18F16F75BB8D24942C8E43637B8BE81C433674EBA5B8B56566D05FE383ABF1D80E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468235, "uuid": "0b8fffb7-6bd8-4b1a-a0d7-d9abf0f4fbd3", "value": "24576:hoO6MzGKpSFduds9SoJcTabEFMJPTcPpKz95vfUl3B224LOVjs2go80JY3TaWjRJ:umwPE6kUQiiHplvBurPRPSy5EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468235, "uuid": "a36bb1b0-fd7e-4465-9167-32efebd6ca02", "value": 4128952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468235, "uuid": "04a68168-ebbf-468c-b949-2a225a880fd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468235, "uuid": "62b94812-4e9e-4290-9513-048b12f2e21b", "value": "bizy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b570842f-cdb1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764482358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482358, "uuid": "15efa9a9-a712-4934-af1b-2461de24b859", "comment": "Malware payload (Mirai)", "value": "b8923dafbcd3c56c02691ee7ac6997e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482358, "uuid": "ccde5b18-2a5b-475c-bbd1-c7b347eaccbc", "comment": "Malware payload (Mirai)", "value": "605c4fe0f55687d84a69b7a39ceb4da4e4c37e77a6abdfefb0d9787d59c08b4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482358, "uuid": "a9dee3ca-0fc5-4249-a8b0-5fc5324b3a72", "comment": "Malware payload (Mirai)", "value": "c33f5105c37ee8f1413cb889571bd8a818792e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482358, "uuid": "b3cf6408-8e60-4916-a29c-d5cc2ef007c8", "comment": "Malware payload (Mirai)", "value": "bd34a457d933c7d06c6718c85323f94467492c138435f66de9413a43494694f89aca101cf6090ae5359ca91604665751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482358, "uuid": "b228a3e2-74bb-452b-90a4-4446bc3e0865", "value": "T1EAE31745BD419B16C6D662BBFF4D428D7B2B1768D3EA31039E255F20378B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482358, "uuid": "abaa6f45-f4be-48db-b872-ced0d5d46eda", "value": "3072:5uqY1srGJTABPe0+0cf4Ctk2udcPeYNvdkUbi9Oo:5uqY1srGJTABWt3f4CS2Ac2YNVNi9Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764482358, "uuid": "b931100c-fe45-4efd-abf8-67d754efc82b", "value": 155768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764482358, "uuid": "3c6a9cbc-0b01-4619-8eae-35d682c13800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482358, "uuid": "0e309db2-3581-4a74-90dc-a551f48eec66", "value": "irannet.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c271d8-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538804, "uuid": "ec887c90-6fa0-49c2-af16-562a6e526a47", "comment": "Malware payload (Mirai)", "value": "a92b25f165abd5fbd165864bb963a472", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538804, "uuid": "c0e33209-f944-4262-8a2d-4b36dac43f69", "comment": "Malware payload (Mirai)", "value": "6134e9f39f34f049774ec15051e78ca0632c110fdc7d6258707ebf60b79313bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538804, "uuid": "398bbb4b-f36f-4cc5-998a-6e7f72c13560", "comment": "Malware payload (Mirai)", "value": "a7cbf2ea54fa8a4b902e81198892e43c16177e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538804, "uuid": "f5eba66f-77ee-42e2-9fe3-164d12cdcc6e", "comment": "Malware payload (Mirai)", "value": "161e56096c1cc01d410371140b2b252599b908ab0bf33134f915e1441af42aeec7aa7011615539ed5412d12bdc8d0706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538804, "uuid": "eaa2c1dd-bb73-4b3f-a3cf-9f8318a2c26c", "value": "T129D35C0677180E57D5A34AB0263F1BE083FED5D121F4BA89291F9B6A4672E3B5481FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538804, "uuid": "dd1011a0-fa92-420d-875a-eb1402eb54bf", "value": "3072:yUFczWKlZhc3JiwmS7nHr2Um/u4SM89tkbb:yvlo2kHr2Um24SM8Pkbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538804, "uuid": "9a30a772-3efd-4839-9180-b8baa549a244", "value": 134328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538804, "uuid": "c7506cb9-7d32-4b1d-8c2b-ef31a5f5cc96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538804, "uuid": "9ec546dc-3e90-4efe-9fd7-19aab57e3606", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8166858-cd82-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764462203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462203, "uuid": "0e2d0d25-6112-4515-91fc-9711f59a4800", "comment": "Malware payload", "value": "eefbf363f40d5698999ab0989a9602d0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "okoport-icu", "colour": "#0A720B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462203, "uuid": "579b0568-c8c8-4177-ac8d-6764014bf821", "comment": "Malware payload", "value": "61847a7d3e973d428de135a5ec28fa69728563db6bcb8d53a495a397b34a17d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "okoport-icu", "colour": "#0A720B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462203, "uuid": "c8b63a56-d703-495d-80ee-a40dfdc6152f", "comment": "Malware payload", "value": "daa3c20007205e875af75b2a6f330c888f7222ab", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "okoport-icu", "colour": "#0A720B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462203, "uuid": "3475d68e-bc56-417b-95b1-2c11c56ff35b", "comment": "Malware payload", "value": "60c8e0b26e92cf5a7ce702caefa04531eda67c0994b8eceabf94722a427b84076debef3cfd701dcf3e49033738f878bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "okoport-icu", "colour": "#0A720B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462203, "uuid": "d6934a2c-2d1d-4136-bbd7-9d2ead2935a9", "value": "T1AC01423462C7A0E1F4D57B4CCAD20980A2092D89EFD2E638B175BEE63A0180ED453B38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462203, "uuid": "1f19af82-0c10-4ee9-a6d4-5116471a5d5b", "value": "12:J0WEYnjCTql4qeB0JV9lJ3wjWVSgnZfzolcipJlkXXq1PUXiJSmlCpPZz2y+4:BlQQx3wjExZZ+JlkXXqceSPBM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764462203, "uuid": "36659242-ef34-4ee4-876e-5b6e8e41aafe", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764462203, "uuid": "f7a3c735-04d0-462e-bcb7-e102f23e941d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462203, "uuid": "26a41cca-088a-4e8d-92b7-fa020b748c6e", "value": "README.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940112ac-ce07-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764519239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764519239, "uuid": "4d427c26-ed0f-4ffd-845f-99e0eb7ab7b8", "comment": "Malware payload (Vidar)", "value": "1a3b64fb427061df323ef9ab5bb56b6f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764519239, "uuid": "99e0b0f3-7f45-49f8-bd92-6f604eb40271", "comment": "Malware payload (Vidar)", "value": "627dd55ec29e98ae676e1af5a12ec9b7a5c234fdc6c290ac8ab8b1a748b0f213", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764519239, "uuid": "a94dbdbc-2893-4a39-a4f7-86a63ecf70eb", "comment": "Malware payload (Vidar)", "value": "36f3af88ee490e46c8bb1576a985f8d376f775aa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764519239, "uuid": "c74fbf27-445d-461a-9d0e-9a26b5e7cab1", "comment": "Malware payload (Vidar)", "value": "3996e514734d8db17995cb2b55cf71654a43e13a0a5347ec5b12658f3fe703c0be2c6d0a26539f63ee336e7bbbaff79d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764519239, "uuid": "f54790e9-9bd7-4b2a-a5ce-35b1419cfb39", "value": "T11B952353CA94D303D4906BF60A63DFB127693F0C9251A2FB5AE39DEB7E246205CC8547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764519239, "uuid": "e135ca11-d8dc-45f2-a1d5-904cf0504dda", "value": "49152:HVf+5NzI4H1Fu06fh6mxzFMF/pt5hQus:HVyzI4f6pps/pt56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764519239, "uuid": "c2985112-b6f2-49c2-9e03-68daabd68554", "value": 1883648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764519239, "uuid": "52285b88-e367-4038-84d2-ede35f2cdaf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764519239, "uuid": "efd9563c-56f0-4b15-9149-f69fae1ae516", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39354ec6-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540132, "uuid": "620ffe70-23c2-47c9-ad45-0052c3be8964", "comment": "Malware payload (Mirai)", "value": "d529ad3bbd6c2d3f26ffc2a63204a4ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540132, "uuid": "ea6f9d78-f758-4637-b29e-af5ee0eb543b", "comment": "Malware payload (Mirai)", "value": "62cded321189100db2468c1168e4fd4c82841f837ce3e5aceb2873d4154b857f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540132, "uuid": "9b374d9a-a2c3-43f1-8197-7b85ea7881aa", "comment": "Malware payload (Mirai)", "value": "52150afc690a0ae4e3b69a2ce8715bce1d531eaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540132, "uuid": "9a699389-c555-4258-ba67-02fa6446242f", "comment": "Malware payload (Mirai)", "value": "4db3584d10cb6a40cbedb4e76e334dbd063c8231558c62aef1f1f41c52c90118fd167f34e4cfa3693a9338c95eb7fff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540132, "uuid": "0db61389-d2b2-4311-ae90-87990429c063", "value": "T13BB2DF3C1B151A98DE1EC0BD839D0B603DB41F259182AD8B6207EDD7AF9A8747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540132, "uuid": "3cdf7edc-719b-4d3a-a2e1-f04b43529424", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui2DmdzJgGlzDpH7uNj1JAM:neD8ZSWvZHZbs1row697qohQvg92izJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540132, "uuid": "53c4c26c-e61c-4164-8568-6175408c290b", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540132, "uuid": "8053edef-8959-47df-8423-e4ba14da4f7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540132, "uuid": "a08f17c9-d5ab-4751-99ac-e361169676da", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18952b26-cdd0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764495409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764495409, "uuid": "674cccac-b7be-463a-acb2-4448ff13a799", "comment": "Malware payload", "value": "c58df6ce718279312867d4292f1fe513", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764495409, "uuid": "5760a746-ee33-4824-89ba-cd8413ad91c9", "comment": "Malware payload", "value": "62d24c7ce0851477e444b09d01c73645bfaf1471c312215ef1d58caa1e52f532", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764495409, "uuid": "85263806-f660-4156-8a48-563f72fe30d8", "comment": "Malware payload", "value": "ae5db45bba667ff49144448ba643a3ac19787d28", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764495409, "uuid": "34dd1857-2829-43b5-aa4b-e6840fe2deda", "comment": "Malware payload", "value": "c49b833f9ae4d9ae1270826daf94b17a3992e0b5dcbe26a80fb06129d008ad31fa88ce27e60c5184e17f88a9d60fe3be", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764495409, "uuid": "cd56aaf0-4e70-47f0-afcd-482010380908", "value": "T1E573205909CBD8FC99B7748C8ADFCC41E7A6A803121CC6E6BB4DB5B62F1247891F49D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764495409, "uuid": "f88bb952-e5a3-4ea9-9ca7-8ca49c28c9df", "value": "768:3y4y/r/wScFg35OCroMkdgWJ7HVf5mdzvOYNwOegOKP/tEf8mqQIkZy4hZDAbXhg:AHgBAlvUU7hjCIIpx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764495409, "uuid": "b29c7aad-5f07-4b20-a3de-50412f1dd633", "value": 76144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764495409, "uuid": "935e37f7-0b8a-4faf-88fa-5ba5360dd1d1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764495409, "uuid": "50d7d59d-eaf7-4b5a-a5ea-4d9e110e9751", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e0dae2-cded-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764507932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507932, "uuid": "771a413f-ef32-41f5-bc79-63f80cad608c", "comment": "Malware payload (Stealc)", "value": "f7e2ff1015eababc841809e0dde3a3e8", "object_relation": "md5", "Tag": [ { "name": "77-110-119-89", "colour": "#E8BC8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507932, "uuid": "badd308d-4a55-45bf-9373-ec23b54ec3d0", "comment": "Malware payload (Stealc)", "value": "62fdc09a082ad65c3d6b81973896bf6863e4df1dfb899eb163db296a8f947e36", "object_relation": "sha256", "Tag": [ { "name": "77-110-119-89", "colour": "#E8BC8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507932, "uuid": "cd465507-4800-49cc-a299-493e97f98e84", "comment": "Malware payload (Stealc)", "value": "f309d23d6aed5e719b7bb0de2f22e87f03a79221", "object_relation": "sha1", "Tag": [ { "name": "77-110-119-89", "colour": "#E8BC8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507932, "uuid": "9cb27868-dcdf-4f45-91c4-d43591e142ea", "comment": "Malware payload (Stealc)", "value": "794da12f50612ebae6f8f80a743ae885694e9cbf2c2243164db6ce348f0e962678449daa784cdc1138d99804ba6cdda1", "object_relation": "sha3-384", "Tag": [ { "name": "77-110-119-89", "colour": "#E8BC8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507932, "uuid": "d536e3bc-bd19-4ba9-bf0f-a22e90759045", "value": "T16106393A5AE529B6D3D78332D038A8A427F237F1354E59BBC099D7650CFA1638B1DC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507932, "uuid": "09d779a6-d33e-42e5-a11b-9154fe9b8176", "value": "8bd032695b1e57f56b9d23c1e6e66617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507932, "uuid": "63fcdeeb-069c-4836-adc0-8f793b8bb9bf", "value": "24576:UaitXRFaS/SjllxHDbQyGGCxx5A7FJ2m/+04u3OWRxHjktnUHiA2bPBqc3DaI985:pitXR8mKll1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764507932, "uuid": "2d846100-61c4-4321-948e-bdcde291750a", "value": 3929088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764507932, "uuid": "2e88f0a9-8820-4398-aeba-4c7788c0dfb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507932, "uuid": "57ad5b47-2b38-4b6d-ac2b-2834bfbe2f52", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73089eee-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540229, "uuid": "7cdc5a5e-b649-49d1-8e37-aedd5a3ce530", "comment": "Malware payload (Mirai)", "value": "73873efff75ac1628c9ba525c4a2db92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540229, "uuid": "9f967ace-cca3-4e81-a24f-a1f9b4ffeef2", "comment": "Malware payload (Mirai)", "value": "631b37932546637ae875f192d458cdff97a0aa0cac5ede0dbd12ba41c7ae98ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540229, "uuid": "7ceebe53-ef12-46a4-825e-fb7d47bd3308", "comment": "Malware payload (Mirai)", "value": "76b0bfcb7ef5d93053ae7e2f4eaeba7c35b88c45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540229, "uuid": "48715f0a-070b-4855-8ea0-63dd5c24378c", "comment": "Malware payload (Mirai)", "value": "a40fe9485136976ba77006b06b042a711d3e39f40a7441b5b9a7c4f91780aa70f631dd99db4b9deb50cc4b433122a84a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540229, "uuid": "afbfc419-d9f6-446f-aabe-d164019c31cc", "value": "T19B630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540229, "uuid": "1dd33347-7ae7-499a-8cd0-df9f4a5b2b73", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540229, "uuid": "c41738d8-3adf-4436-a505-f73b76c105e8", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540229, "uuid": "d7d66156-dbb6-453d-97bb-429485a9f38f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540229, "uuid": "ae7b23d8-12ed-4e2d-a842-d0be4a074511", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4600a720-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540153, "uuid": "a5c02b36-5908-4c71-8731-2e48b3976f78", "comment": "Malware payload (Mirai)", "value": "496c8ffb490f66fed7c1e889c39b2bf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540153, "uuid": "22a904c4-b5fa-4528-a4f5-a44bee75a8c9", "comment": "Malware payload (Mirai)", "value": "6362b0ce0d2c2d248ef5082ea4ec994e1ccf8618ade8489ea4f5f20147fe7b78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540153, "uuid": "f2a8a3cb-a0d3-4377-97ec-db2969741d5c", "comment": "Malware payload (Mirai)", "value": "5905d1d2b29df9cd249f1717fcd1d1b417028d34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540153, "uuid": "2b082e37-b8b8-420c-92df-3808f66464f7", "comment": "Malware payload (Mirai)", "value": "e013a4b9d71c6409824921ef9af04b66b7ef3b05ae608c9cfffe70e9ada878e0b4d5fcec5f634e0f6ded6d2475c8af77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540153, "uuid": "e9a2d568-f7a3-4110-920d-e06247d433ce", "value": "T1D4A3290ABD819B11E9C525BAFE5E528D335307ECE3EA7102AD145B2D77CB92B0F3A411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540153, "uuid": "7fecddb0-a05e-40d2-a96e-03925f5e978d", "value": "1536:fMnqOQ2LmPxRP6l7HatOwIQV8ucKeI87ZvPil6Liali9arCgvCY7j4wk0oSSi90:EU7PXrvVvcKeI8Znli9arCgvCnwloXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540153, "uuid": "282f364e-1943-472e-9fac-00360bcda5ed", "value": 106668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540153, "uuid": "66144a14-98ef-4738-8da4-9b8d79ebb4f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540153, "uuid": "309f49d0-3670-46ff-99c7-a69de5caf4be", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebb5dc7-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538799, "uuid": "47a2097f-f4d1-4efc-8c49-30f2863a4b4d", "comment": "Malware payload (Mirai)", "value": "35216de8bec01d6cd32b498bd777b8c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538799, "uuid": "82a06391-b1b5-42be-b643-ff8272049072", "comment": "Malware payload (Mirai)", "value": "647a91a62b6a8d749742e5ff4ccc788145ad043fcb53295ce6fc20e2235a9fe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538799, "uuid": "d195509f-7ca9-48a9-b471-92c3b280f087", "comment": "Malware payload (Mirai)", "value": "4826022b4ad22c81e3ea776cfa9d75f31aefed21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538799, "uuid": "fdba335f-d7e5-4320-8263-083b88e995d0", "comment": "Malware payload (Mirai)", "value": "60d9de687a169b3353c7958bd6493aa24cca605bc575bad0bb373603f10cdb1f4fc4d23403160440daa8708791795164", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538799, "uuid": "2def16f2-c069-4896-b7fb-ad912dd795f9", "value": "T177E34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD105F2577C7A6B0DB7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538799, "uuid": "f9a9b4cb-5adc-4035-9b5c-d784b7be050c", "value": "3072:kNcMOvrpToDzK79MeQzlue1k6aU9zL6EiueCo2kP:gOhoDzKxMereS6a4IueckP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538799, "uuid": "cd4b91d6-8e34-468b-87bb-42776f7117e9", "value": 145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538799, "uuid": "cab15f94-8c9e-4a6b-b5c2-0c6130877d65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538799, "uuid": "80c09f34-9071-4d63-9235-6ba18b0c6882", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4a4710-ce25-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764532193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532193, "uuid": "f5daae97-7d7d-4168-8e25-2bfc2de5f6ea", "comment": "Malware payload (Mirai)", "value": "7383e41fd3a96a94f2ace9ed64a3bb1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532193, "uuid": "bddeded5-8b9f-4179-a62f-1683c664be12", "comment": "Malware payload (Mirai)", "value": "6490f23973ca989d6c112b320b0f583cbf22c28749e555e820bda073cad73728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532193, "uuid": "cc042315-b395-4623-99a5-628e5ef9f77d", "comment": "Malware payload (Mirai)", "value": "eb6e81bc9bb52349c0e6553058391130851d1122", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532193, "uuid": "7cae8a5f-f6ad-48d0-9bda-f437e9713327", "comment": "Malware payload (Mirai)", "value": "da561ea87a8fcc01fe345be3a06c249a87e5b04c146365c653f09afe53f2cf062f51b2b5870ac570a38766da4ae0ae27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532193, "uuid": "6d001ba8-abae-4437-b84f-17b7675ebb92", "value": "T116830749FD819B15C5D822BEFA2E018D336357ACE3EEB202DD115B15778A91F0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532193, "uuid": "c2da4d5e-9e7f-4eb9-a0a0-c159f527372a", "value": "1536:m5nRTLidKwozQfR2q9bOHHJwMclPTw+AQXdlQfiYHB/+LuY:sWd+QfRL9bOHpwMclPTwLFHBmLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532193, "uuid": "3c2f9aa4-45fe-47a4-92e1-8b6d8ab4b752", "value": 81092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532193, "uuid": "75195d31-c167-4239-844f-bc01bf6abe22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532193, "uuid": "ebb072c5-bb5b-4025-a2ec-e5f3f9d01f0e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8ee32f-ce23-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1764531121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531121, "uuid": "e10058b0-afd5-49b1-bdad-1dadc9bed3f3", "comment": "Malware payload (CobaltStrike)", "value": "7b4fe3fe0fad480f104c1ad19adbe22a", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531121, "uuid": "7dec64c8-5627-489f-9ec9-4f869bc6d67b", "comment": "Malware payload (CobaltStrike)", "value": "64db468d9c3d860ef9f014b1b7020a1089249eb169220cc3bd3018f232b992aa", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531121, "uuid": "18d56e07-a336-4c00-8a99-8debe4b37c7a", "comment": "Malware payload (CobaltStrike)", "value": "8ab5506ffb55b501d0aa88a52e9ae81f2f9568ef", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531121, "uuid": "201ec8e2-a72b-4adf-ba1d-2f1f36c073cf", "comment": "Malware payload (CobaltStrike)", "value": "40cd58802e0c34c8e6c5403dd4a38ce469bb603beb42867dda2c689491e7a0792137f37f413ba3c58def8e8c4ab87d5d", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531121, "uuid": "00d8c0e1-9cd0-4b3e-94ed-6fe5f2237fdf", "value": "T170425B81FACA0DE6E73443F2C0370A25E5B6BF2513624ADF0B7471162DB52D299726CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531121, "uuid": "0ffdd521-c163-4d17-9d54-5ee23caefe70", "value": "2fc884c7d3280fcd62bbb718bdb13a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531121, "uuid": "63c1aae5-03d4-4f50-a62e-b497fd30c70e", "value": "192:DKDnqsvW1zeuBj0WcSSmnjkmSnBCfhECqWyQiBi3Q5tfL3mc:27PvqeuBjimjqnBCmBi3OWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764531121, "uuid": "7027a162-23e6-440f-9ce7-6812687893e4", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764531121, "uuid": "e20afa59-f4ff-41bf-9aac-8947268d0384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531121, "uuid": "47f9c0a4-53c4-48ed-98f1-c6f7c26b89ca", "value": "tufaqixiang3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28217424-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496724, "uuid": "853a90a8-28b0-483d-b4df-78d51c509238", "comment": "Malware payload (Mirai)", "value": "b221970d314fa9b6fc2a60456d2f4435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496724, "uuid": "9dcb17ec-18c0-4b4d-a943-8447ea870f74", "comment": "Malware payload (Mirai)", "value": "650acfa309721ba10798195cd66f8ebd84c6b11adcba0fdc3470211447ff06b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496724, "uuid": "ab8980bb-ad32-4fb7-aae6-c95c3fd447ca", "comment": "Malware payload (Mirai)", "value": "a85533961e54c5cd36d0ac45a5a9475122a761a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496724, "uuid": "8f1ea562-ebde-404a-b907-643ff0d6cd04", "comment": "Malware payload (Mirai)", "value": "5d84ad80c2f46e4d96706bd71d7641cec1b40c08e7d5f854f0db8d9fe02b10c32f05273a508b7949b189f52085279175", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496724, "uuid": "293a3a9f-6bf5-4c8f-9c12-d146fff65504", "value": "T11143F160FA505AC3CCAA8CB480EE35756F5A612932EF87D9671B0A80A71D10F757833D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496724, "uuid": "f3b8d7be-899e-4b5f-9bc4-43ad74c23940", "value": "1536:hHrRD0gn1aEVi15uooQJpP8LIYUK5xUStXTI:JdUEiOdWF8KK3Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496724, "uuid": "5df6c26b-abd8-4e80-b48e-0d53e12b6aac", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496724, "uuid": "8b5f2ddf-fe0e-44a2-8f2e-61664ede6957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496724, "uuid": "ad83cf8f-68b3-4e44-a074-a91596bf20dc", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec18f45-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468227, "uuid": "d3bc39c5-7ca1-4e46-aa74-95804265a943", "comment": "Malware payload", "value": "ff79a3aa728804864605a442238b591f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468227, "uuid": "26ca3192-35c2-4888-aee4-1c3edd62ce4b", "comment": "Malware payload", "value": "6598e96fe73eb386fff812ae3dfdd30bab7a6b48865c12ad46180ca9cd06b725", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468227, "uuid": "dda48de3-b66a-41f3-8e51-f9ac9fd6bfd9", "comment": "Malware payload", "value": "a85131585a2f3f311b94ae68da2e9ac23429bd4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468227, "uuid": "be1bf519-09b6-45fe-b02c-8c0c8a3396be", "comment": "Malware payload", "value": "65772afa372609a7bc8097c89011d6e62f0ad0aa984c3828c7c347e3a1ab77934d28bbf0160923bf418af4fdb6c5980f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468227, "uuid": "fc1670ed-2808-4f31-8872-59671d09c745", "value": "T1012618137B68EB0FC21872301DB1DA942B291C8606D79627B795F319F8F20AD496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468227, "uuid": "9895499a-25f4-472f-9f91-e71044543988", "value": "49152:yK7EguFedcfY/OW+b5xcm2uwe+dfTEPt5En:fO2XT+jEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468227, "uuid": "ea9bd247-edd4-41ad-ac50-80fec984a441", "value": 4587735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468227, "uuid": "0f944501-ae9d-4b9b-9f0d-4fe7f4d81a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468227, "uuid": "f851386f-0757-4f8a-8e99-d0ce8b49dd3f", "value": "bizy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2358ab89-ce40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764543531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543531, "uuid": "2037d400-1f39-450d-be72-55f5099de018", "comment": "Malware payload (Mirai)", "value": "d4b1196800c8fa365e222ef3eabb36e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543531, "uuid": "ee022d5a-d11c-4f82-8ccb-9d3263633f24", "comment": "Malware payload (Mirai)", "value": "66199c5c912907936a103184de81ba61e24eb53b8904518659a1d002ac5cd61a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543531, "uuid": "c569b973-cefb-4584-95c3-d146ac33d6b6", "comment": "Malware payload (Mirai)", "value": "21a20d05994d9588ed409b5a7887849e96323789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543531, "uuid": "2c23d2e9-21cd-4eeb-9f50-3d711bcb985b", "comment": "Malware payload (Mirai)", "value": "db63a2c07c9ef837ecb3014e5ec9ea43f6667e7dccc34d20416a6f0913799bfdd1c450ff5a8c02dfda92d3af5ec20951", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543531, "uuid": "ffcf44a9-99bf-4889-a4b8-5b1dc38d8eb7", "value": "T1B8F32A56F880DB12D5C551BAFE0E124E33131B78E2DEB2129E249F317B8A97F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543531, "uuid": "709382b4-961a-455e-a311-e2c63d57a128", "value": "3072:iZYX6J1RvlFSfBsUrgAOkDXFjhfaPAVZkpINWtOCymW7+:9c1RveygnDXNhfaPYZkJymW7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543531, "uuid": "6119a8f0-6669-4438-afe3-c1ad91cb1708", "value": 170928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543531, "uuid": "6847c488-6d9e-4376-a495-c8e3ebf0a853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543531, "uuid": "f1a7ca43-6015-46b8-8319-6f7227751324", "value": "lava.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd2b871-cd80-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764461082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461082, "uuid": "a223c4f3-491f-4b39-9e96-0a5c0ef26378", "comment": "Malware payload (Mirai)", "value": "edf97c80310498ed6735fd537378bb03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461082, "uuid": "baa29043-a1b4-477c-9563-efe20349b6fc", "comment": "Malware payload (Mirai)", "value": "693230d71341f98352a7fa511daad5927823716e50e7e46d9f2bb4baa134d1a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461082, "uuid": "279b6427-ba36-4c3f-a78a-459ac471d22c", "comment": "Malware payload (Mirai)", "value": "b069baf77d404b3a40498dc69fabf3e1fc0c2845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461082, "uuid": "59bef08d-5280-417b-9b50-d68d1d01f74d", "comment": "Malware payload (Mirai)", "value": "32957787f0c6cc234f8df968dcc5b0587645a41c464a85482da2a93e39475fb96df4a4440c85bd817e45ee80eb3331c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461082, "uuid": "d2f22e05-9df5-4b6d-acf6-ad3a78b77640", "value": "T10623F23BE4F59641EA37847704A7AC4F24A9D617F069ADC7E384912B48C47393BB5F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461082, "uuid": "46b19264-e195-4fdc-b8ff-b3e2db11d907", "value": "768:ZIinmP2YwITjZDXL0LlHwWNE7IlEWj9inntYzzAk6kOQoJSRqheu7xqk3nbcuyDh:ZcjLpLgPUAhjEk0Iocu7x73nouy8GyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764461082, "uuid": "e3e8b6c1-1e62-4f84-a2b6-4ce0c3ef0e2e", "value": 47288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764461082, "uuid": "c68eac04-0f51-4025-bf48-f67c0c3d6c9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461082, "uuid": "eea23433-eecd-4190-a9b5-08b41c1625b7", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128ccc91-cd84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764462757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462757, "uuid": "92927343-9c28-417f-960b-8c0c338d43a8", "comment": "Malware payload (Mirai)", "value": "452f5055bdb987b2ea8df9d2d0238138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462757, "uuid": "d5c8733b-1654-486d-b858-9011c5c91e71", "comment": "Malware payload (Mirai)", "value": "69e83aa53811f6116a5a8da6be214f2f24fecbed3c53662ee7d2fb9c7138119b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462757, "uuid": "8894fac0-bc70-4c33-8e3c-145fe6d5e95d", "comment": "Malware payload (Mirai)", "value": "ee30e81866bb37e3bc43a3f9936414499f9949f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764462757, "uuid": "07db53a5-9179-4d62-a1a3-a8d3844c6745", "comment": "Malware payload (Mirai)", "value": "b9e7ca97b83a47c969c04d8573792e8feafd022fa566032c3fd0cdbd3bcca17702bb87d3fb57d07a9f2643560b4739b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462757, "uuid": "b2225b69-4c10-46d6-a0d1-4f9eabf695b3", "value": "T11E93A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462757, "uuid": "ece770e6-4432-4bb7-ae00-d794c7f36a02", "value": "1536:a5DnSB+v5djQm2X17xk49d6xZLu8vJ4TGo8S:a5TSB+v5djQmq1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764462757, "uuid": "607f0435-e86b-42ea-a887-7f00b2144077", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764462757, "uuid": "bf38ca95-7a78-4a73-9e5e-6853cb131bcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764462757, "uuid": "3f32eaef-ec23-4425-81b8-337eb0b237af", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6057fa3-cdc7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764491808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491808, "uuid": "be1783fe-088b-4265-a825-121c246d0db4", "comment": "Malware payload", "value": "c8c2e2286130ab73cc24f9a1129fd0a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491808, "uuid": "5d7a929e-d924-4f6e-952a-094e92894de2", "comment": "Malware payload", "value": "6a253112430db5ba263f7483e8a3f3088004e7993d9eae996dede1b350715bfb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491808, "uuid": "d5cebf6f-98c3-42ba-a0cb-6c43b54fa54c", "comment": "Malware payload", "value": "6fe2b909f857f02910f7e30310ca44bfcb44e750", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491808, "uuid": "04fc1808-43d8-4259-877e-28c4432328ef", "comment": "Malware payload", "value": "b2d68cc044140c29355ac558a9a47f5bf16bdb7561ba11dce9b60dee18882644a8c7e65a35d8a04957e74c1623f4e6c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491808, "uuid": "cb6d2f47-abb0-404b-895f-e7755560d0b2", "value": "T1A1D092EEB27812B0C8CCFB206DE18A6844017B88F58A0FF9980FA135C074EF16012684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491808, "uuid": "f7db77fe-bcb2-4d00-af7a-f42d139a348c", "value": "3:TKH4ow4NLyRK5qRXpsJ1HXHl3zSAULW5MXzXSHqqRXpsJ1HXHeBzSAULWTXXoK1:howNwxzHlQW5mzXSAzHeeWbXoK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764491808, "uuid": "f9724827-ce1d-4a85-9f91-675305d4fe6f", "value": 235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764491808, "uuid": "83749027-a108-47c9-b666-96e44c8413ba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491808, "uuid": "fa0ff99b-4d11-44ee-b1fc-8d7a411582a8", "value": "r.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fd1127-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764530699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530699, "uuid": "1a0d46b8-824a-4b27-aaf7-fed4aa9fb6dd", "comment": "Malware payload", "value": "88695d8104f31fba7fbef2ab2b38e245", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530699, "uuid": "d1a08372-f31d-4fa4-b46a-cabd74408e08", "comment": "Malware payload", "value": "6a6143a7219f352c1d36fc2844861d2faf9bef8c172b719b397c9fbecc031b6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530699, "uuid": "58e7aba6-94cd-435d-b08a-261574c7b4c8", "comment": "Malware payload", "value": "c0ff3dce6663d4099936929394400ff124386adc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530699, "uuid": "9e323b00-9661-4f7a-8a9e-6d03dcf9bca6", "comment": "Malware payload", "value": "2d0f0c1b8c92f93ddcdbdf2a275dc80ee463b24241cd61f65923f07aa4e472e645b5e252705264c88a44be78d35b7283", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530699, "uuid": "8add25be-8c06-4e29-9c12-45f0aaa1daf7", "value": "T1DFE32885F890DF17C5C2267BFB4E43CD372617A8E2EEB1139D255F213B9A95A0E3A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530699, "uuid": "29ed21fa-b1d5-43fa-ae5d-86a16a3f5e25", "value": "3072:xIjw69AJay9F8VP42dRmkcah8i0krjYBPhB:xI869Av3SP42rmkcaGiPkPhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530699, "uuid": "6bff4b20-91b5-43c1-bc68-7b817a6e772a", "value": 153360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530699, "uuid": "1a51734b-7b3f-4325-a4c5-16bd7f91368e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530699, "uuid": "b8c596e1-9e9e-426c-8cb8-e9ca27484459", "value": "lava.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6710dc3f-ce42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544504, "uuid": "0379b0e6-eab8-413a-b6f9-40dc76306ae8", "comment": "Malware payload (Mirai)", "value": "9b419e43ffdd541eaa7b0711db3ace78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544504, "uuid": "6afe9ca6-a01a-4105-ace8-a80c3f5bdfab", "comment": "Malware payload (Mirai)", "value": "6a81ec72b297347172f87ad360d387972e3830c6a34b6c8ce418553a75d7a7e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544504, "uuid": "44caef90-f02b-43fe-98f7-cc1d4a1ac05c", "comment": "Malware payload (Mirai)", "value": "7da7d10200c4e5accd47a60da7979445641d3f56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544504, "uuid": "1c6f040d-fb0f-421e-b77d-94434184f4ff", "comment": "Malware payload (Mirai)", "value": "5ade63974752d8a8b665e10f37cbbb2b5d860d2ea4652930fa3ccf034d8f24dd37a3fd9ac6e23c4c81da2b783812eff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544504, "uuid": "a23fbb09-ead0-4d00-9b84-cefa3eccce24", "value": "T1B033F164D9A66CB30AA4403DCD6482817C3ED7B873CF2253174407697DFFAAE5769602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544504, "uuid": "e0d19d87-298d-41d6-a785-33175d07901b", "value": "1536:dO26s+W5T7wkNhtE6ydgT/UUCKlq0xwbDLC:k+5T7wkP8dgT2KI0iPLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544504, "uuid": "a984d8ec-6c64-4047-aa76-93627ea9f490", "value": 50304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544504, "uuid": "0b5cf45b-044e-42fb-9147-3d6fae1e86f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544504, "uuid": "8409aa86-0e45-4fca-8d52-097b70e5d588", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e716ae-ce3b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764541468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541468, "uuid": "db9ff25b-a435-4637-af3a-965406c4de8d", "comment": "Malware payload", "value": "cf8fcc3804acb0837325d6a068c64211", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541468, "uuid": "1529104f-24e5-4736-9125-79aed55ec2f3", "comment": "Malware payload", "value": "6a886838aeb81325fd171ba4d81f91d8de950d86880a89c30172c2c19c7d41db", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541468, "uuid": "2565e96e-f7f7-4940-b515-a376042a4571", "comment": "Malware payload", "value": "cbb34149b4121d1baa31321f653c46da6bc53ee7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541468, "uuid": "28e0e344-b521-42c2-84c2-869a825ccad5", "comment": "Malware payload", "value": "bcee8bd86ad8d65c9e3a5ec2e3f34f7fa1d05dc66e4e10807467c3ae67b3b39ba0e3df6b463f9148c77978a2a3ab39cf", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541468, "uuid": "1e79eb81-2758-46e1-9774-a9035467ac4d", "value": "T151A2CF7924422714123352F21797DB87B7A006FC3A79D8E12FEECA01B6F52BC9E65C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541468, "uuid": "01ee8b98-8be5-4af5-b36f-01d9ada21cbf", "value": "384:YNf4JSNf4JrNf4JeNf4JrNf4JDJNf4JrNf4J0:YNf4JSNf4JrNf4JeNf4JrNf4JFNf4JrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764541468, "uuid": "f654f6e6-f0a0-4c66-a154-1b30db01672e", "value": 22263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764541468, "uuid": "e3a45909-9fcd-4e5f-b54a-e6d5c381424b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541468, "uuid": "3af55ba1-7b9f-47a3-ad04-621ccc6bdeb8", "value": "FA-21-12-2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae280cd-ce00-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764516271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764516271, "uuid": "728859e2-1f16-4130-bd79-5be2577e9c10", "comment": "Malware payload", "value": "7ea8d97c578ead8cdb720fe21e0f7fb5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764516271, "uuid": "21115759-acd7-415a-b715-c7ee50c242f7", "comment": "Malware payload", "value": "6ceaff91e1916e67810b1ff64c53d66a771e532e99dcd2262382d24d971d0f1a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764516271, "uuid": "8b85bb02-c4c6-41f5-9177-b815e5b6fc89", "comment": "Malware payload", "value": "da0a30842a88fa3e10b02d230bd40b6387a7700f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764516271, "uuid": "f719d291-9bf4-4e50-b790-cc8324036f55", "comment": "Malware payload", "value": "e344371c769616872c1cb0f4b4a676f5e40e3bb9ef2e15d45f97b9e0cafdb8d232010f1696fdce7799ef5a1f891b3fab", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764516271, "uuid": "a0e8c9b1-f07e-4799-9dc3-e559dedfe00b", "value": "T16973415909DBC4F89A27749886DF4C05F7ED8913121CCED6BE8DB9E42F2183891F89E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764516271, "uuid": "a69b96f2-b3d4-46cb-9040-25fb7a23e1ab", "value": "768:Eq8ceHNX7gXQvHrzfJhtvlAA/ad8SNaLbDCPnSjPyKgcRga1ejLVpqNFPS3P8Kh3:Z867wH17M30Y7BEwK4IvXi4xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764516271, "uuid": "b2ca1554-8a21-4c29-9356-c7c038539325", "value": 76421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764516271, "uuid": "c19ae3bb-4b54-49cd-abc2-16b6ca64ba6f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764516271, "uuid": "6393d794-9940-42c4-a3af-ef92e1066cf4", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf2a598-cd8f-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1764467605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467605, "uuid": "a0dc73d6-0a29-465a-8002-7dc94adeff3c", "comment": "Malware payload (SheetRAT)", "value": "71eb643f1456893a50b077df52499a5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467605, "uuid": "8c0955a1-3eb4-4727-9714-5b3c9900a106", "comment": "Malware payload (SheetRAT)", "value": "6e70dede1d7afa1f3d865909dfb05ffb807063f80377eb251b12980103c5dab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467605, "uuid": "67d6e2b6-ef51-4d74-9f9e-6afc7355b134", "comment": "Malware payload (SheetRAT)", "value": "d76f027594c1d5680197c6970899397bd58c1174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467605, "uuid": "cd86330c-cb14-4555-891e-b63c1edb42fb", "comment": "Malware payload (SheetRAT)", "value": "fcbc7c2432c703dcbafa0c2068c92093c8e15187ae84eda896f9f6f5f11766307f494aee4ed91fb79fec2d0699c3bb63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467605, "uuid": "e96abefd-dbfc-4a76-93ed-e7b8fe7aff18", "value": "T109E4910CBD51FC15CE6E3CB38BE291A11B7200C63E129516370A6FFA9B653B659A307D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467605, "uuid": "49518081-f8ae-4014-9f1e-281c2122d18d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467605, "uuid": "25683368-57f7-48b1-b0dc-975b1f6d9595", "value": "6144:sd+8h1EoBk/NN4MMRdER1dg48y3r209djnPZ+cD6SARxXnEABbAzUYxM+NgqIvld:ohpBk1NqRUKy3xcR3fNFI35++hguv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764467605, "uuid": "653cf818-6b43-4f72-b281-40777de4ce8a", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764467605, "uuid": "54f86a4a-465f-454c-8e99-382c9fb610bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467605, "uuid": "82577f45-0fa2-4632-8f3a-e3f38c207d8f", "value": "DFChecker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1d361b-ce16-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764525453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525453, "uuid": "ffa62708-eaac-4111-b959-24738a052d53", "comment": "Malware payload (njrat)", "value": "b5b92ab89e76a8e5c5c78a9d27fe028f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525453, "uuid": "18e64e22-7d93-461e-a0fc-c5982b06e7df", "comment": "Malware payload (njrat)", "value": "6eeb5788ce02a71cee8cad314c4f1c467ac0dc77b23cbbef4f3a38bdfbd75f46", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525453, "uuid": "7ea7eed6-d4ac-407a-9c08-8f352b8abc21", "comment": "Malware payload (njrat)", "value": "53952ba9fae92082bca524d2deec7fd8589f49d2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525453, "uuid": "89a14525-1ed5-4c8d-8e30-7026b404d149", "comment": "Malware payload (njrat)", "value": "a1037132e5e4fa9202b86c997be53e4cc25112ed4f31b7695c7e7b1b1af0c311d2fc7a36f7e741b3943aaede1f8d17f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525453, "uuid": "7fa0a052-9ee9-4650-a8cc-05ddea00c49a", "value": "T14B25C09073F4860BE1FF6B75E4B149494BB7B9529A36DB4F09C890AD1EB37408E113A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525453, "uuid": "c715c99f-c36e-4d23-aef4-5313328dff6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525453, "uuid": "c9475cab-c401-405c-911f-c541804b8780", "value": "24576:aXUeVxJzck+uGW/yFoBkkAQ3oTXQ3U2y6mC:aXUeVTYjqqanT483ZyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764525453, "uuid": "388bcfca-bd28-48e3-8679-a982ebc54741", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764525453, "uuid": "9252206a-b94f-4375-997f-cc35a7659338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525453, "uuid": "77cda898-3c53-4e50-9777-f8bdfb47f214", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9456ab31-cdf3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764510649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510649, "uuid": "201113ff-d4cb-4ba2-ad55-677659c59bc1", "comment": "Malware payload", "value": "33f6af89bff618bd645d9bb4bb941060", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "js.agent", "colour": "#64B5AE", "exportable": true, "hide_tag": false }, { "name": "Trojan.GenericS", "colour": "#0F5520", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.Obfus", "colour": "#8F3CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510649, "uuid": "c26ca79f-8139-49ee-a6e4-ef9a4bb62e22", "comment": "Malware payload", "value": "6f0b06e875cac91a1c1a541ffc5e3649615c45af49f1bc7693a41c62b1812289", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "js.agent", "colour": "#64B5AE", "exportable": true, "hide_tag": false }, { "name": "Trojan.GenericS", "colour": "#0F5520", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.Obfus", "colour": "#8F3CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510649, "uuid": "41f93c1f-f231-4622-aa1c-5738319fd9c3", "comment": "Malware payload", "value": "c35f2033483c536361411436215d47c8b0c0b5cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "js.agent", "colour": "#64B5AE", "exportable": true, "hide_tag": false }, { "name": "Trojan.GenericS", "colour": "#0F5520", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.Obfus", "colour": "#8F3CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510649, "uuid": "111b5949-afc2-473f-9d20-036b302b9b8a", "comment": "Malware payload", "value": "f21a9dd8d0b43bfeb72e179a4abc4095fee9c4c6baee683c709ac7f31f37d812c80ec4d7c87951b50f62306b0ea5b7da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "js.agent", "colour": "#64B5AE", "exportable": true, "hide_tag": false }, { "name": "Trojan.GenericS", "colour": "#0F5520", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.Obfus", "colour": "#8F3CB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510649, "uuid": "b7c1dc5b-ce7a-48ca-8888-a32721e4b1c3", "value": "T1D6846444B7C2B89103975B76731FB6D6E93E4DE871C8084BE114FCA4F9B5A09EAE1930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510649, "uuid": "04f7129e-ef75-427a-9beb-b72e3b851138", "value": "12288:s7lQKuXQhaT4RRs/cowA2odnyA1m26/UY:eQKcIRSbwA2odX1mNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764510649, "uuid": "c975598e-c34d-45b5-aeef-7dd883b2cb33", "value": 400396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764510649, "uuid": "0b777572-e356-4e2e-aa71-4c79891b624f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510649, "uuid": "9d1c97ae-1d0e-4284-aa5b-6f386e0f7adb", "value": "9d592254-4cec-4fe3-bb22-aa00f3c5dffd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8c1ff0-cda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475496, "uuid": "13270a18-e410-4f6a-92f0-e7ee9a2c974d", "comment": "Malware payload (Mirai)", "value": "492e65a61c3e1c78db1684f560ad60d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475496, "uuid": "32b159e2-8f13-4804-a9d4-963ace6e4de2", "comment": "Malware payload (Mirai)", "value": "6f698594fd0b4b379f9b5ffa9aeb30c677ea20fb9fcb3e31d3323e3e1ae6157c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475496, "uuid": "37cb406d-7008-481e-9e04-2a9726d57d5d", "comment": "Malware payload (Mirai)", "value": "b1d0afc64655fad9c419d1413435a114289b30ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475496, "uuid": "6f947d05-1f00-4299-a3e6-3a49cf820b38", "comment": "Malware payload (Mirai)", "value": "36d00d08575fec93159cde36b3e03a1b30536a65a882c89015468a41290e4718b961e671444f0ce7f7547070f736df72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475496, "uuid": "4a059e7d-c515-4411-a59e-f18e7d6d041e", "value": "T15F534B96A004DE3CFD4FF6BB84160E04F638A75455820F27A7AAFDE36C720D94D5E981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475496, "uuid": "e26dbc16-933e-409e-910e-ce2a481972c6", "value": "1536:dZyjslOj38ScRADAkAAneWUYmgSp1lmwKXLG8wNyPoU:dZyjslOURADAkAAnjU/3pxK7MU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475496, "uuid": "8bbe89e7-af72-4822-875c-a3a829e76f92", "value": 60680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475496, "uuid": "91a2f5cb-d1df-438e-8672-77b3eb38a5aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475496, "uuid": "9753d452-156b-4857-8475-6388a771a4d7", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c7a223-cdf0-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764509365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509365, "uuid": "48929fbd-4c82-4e4d-8991-e27a0f5adbdd", "comment": "Malware payload (CoinMiner)", "value": "080cfc15b80d1181e87a62bc3048023c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509365, "uuid": "f6d37bd1-5194-4147-afab-f8c2723b75db", "comment": "Malware payload (CoinMiner)", "value": "703e464b549be9dbe28d1ca39d04432b4d973ce82ae3044619d2cf1a60f90094", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509365, "uuid": "ff69b7a7-9e0f-42a8-8056-bfc95d1db036", "comment": "Malware payload (CoinMiner)", "value": "22435d73b502fc0fbe7ce31c37f20c10a3e31261", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509365, "uuid": "8e802531-5bd6-4b7b-afac-afc7de49048b", "comment": "Malware payload (CoinMiner)", "value": "3d54b4f9f6e3edc13cb0bbe5f8c97ce8ce7141c74a0e6181231ca1569febad6d44b1558cbd59afae22b751fcf43ebb24", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509365, "uuid": "ff65858a-27ce-45d9-b8ad-07986cfa53e6", "value": "T1887733A7C46AAF3EC533C839D691645E884B6D4095630E1935E9B04BA5F3FD0B3FE029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509365, "uuid": "1d95831e-c245-49da-bf5c-0ca98fa21da9", "value": "786432:U7ERTheIyNxrvJymrBMhs4+NwgK9CAjVc66oK46sOSQB5S+I:UwRTMpryhs4I7K97VKb2cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764509365, "uuid": "850a61a2-9836-4d15-b11d-4cc6d4dfed8d", "value": 35512320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764509365, "uuid": "ffc70e95-5ab8-4bc1-bbff-2c92843ed87c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509365, "uuid": "71d1352d-38d2-4896-8c7d-405207789ab0", "value": "lnstaIIer-x86.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4e2392-cd93-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764469589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764469589, "uuid": "fdbbde8d-d303-45dc-bd08-b94efb4e3f91", "comment": "Malware payload", "value": "5922a1adc691970e850e406a18bfec57", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764469589, "uuid": "f5066a82-b443-4a60-99a4-2a1e1ec627f4", "comment": "Malware payload", "value": "70a06f67fc7478f77ba341fbbe10aaaa00cafc06dcd948c3e623914d4a5e2c35", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764469589, "uuid": "5c60cc2e-d4ed-4de4-83f9-25da92718c3b", "comment": "Malware payload", "value": "10986a370ffcb3dfd4cc07bdf7b7d8fb18cf5e0d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764469589, "uuid": "511646c1-cb08-44b8-b274-2459fef0ff27", "comment": "Malware payload", "value": "9857a5e685a76bcfb89337922e8480b45c1eb2276804ee31d18050f693dfb7e9645d9652ad727333954d46e724b97ae0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764469589, "uuid": "720f2110-a650-4ccb-a600-de49078ab80e", "value": "T16B94D69067F94604F2FF2F79A9B245114A76BC93AC35D34E098694DE0EB3B81DC21B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764469589, "uuid": "b16d224d-2c2b-486c-8b18-ca242d9e1474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764469589, "uuid": "b5943173-8722-4c18-844f-a5d621e852cd", "value": "6144:VPJiQz7AGn4oXNJA91sL59j17WimTvpqBZi4PjAuMofwa50qHY9bHLMgdMN5A:2QzLnXA9qLJ7WFm/jT50ty5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764469589, "uuid": "13389613-d84b-4b49-a7a8-b998f7cb1111", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764469589, "uuid": "a0973d93-7ac5-42e4-a8eb-8930d7d8563e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764469589, "uuid": "352418c2-63ed-4a96-a08a-615d435ea861", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65031669-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468050, "uuid": "5a5db53f-5644-4434-8ee9-8790c691a0ab", "comment": "Malware payload (Mirai)", "value": "4b5e7de18b890fb1fd411f0664d6aaea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468050, "uuid": "4807a2e7-c688-4c18-b4ed-61045208c2b2", "comment": "Malware payload (Mirai)", "value": "730b9a633810475de79891eb9c75d6c643c5a297a59481a7a329e164eaa2d70c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468050, "uuid": "c17113e3-42f3-4365-8d1e-5eb471496366", "comment": "Malware payload (Mirai)", "value": "ccfee72ea0ae82f958cea15f455e9cc0fc6bdef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468050, "uuid": "58c460d4-6fad-4a3b-a718-72160c7da062", "comment": "Malware payload (Mirai)", "value": "8ac88bbba9e7915312941667e127f605ea267579fa8806ce1403b3290339408d762d1d92c3941f1a7731c0bd2bd0687a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468050, "uuid": "ef8f21c6-34c1-47f9-82b5-c5d84d38621b", "value": "T1E6530204CE53DEF2C5A014F5ACF446DD9E9A87BCE15451CB8B2882087842363B2F9D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468050, "uuid": "60282da9-945f-4f06-831f-a3a46790c8c5", "value": "1536:YSPAv9p9ZmK/3EDw7IKQcams0HfJfJBO0dOSo+RasWLj:1ov9pzmK/xIKQcaKfla0dOp+RTWLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468050, "uuid": "a44e3821-e71b-4f19-a06e-a48186c10ed5", "value": 64432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468050, "uuid": "4e072f3b-1794-40ab-921a-871489c4c435", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468050, "uuid": "fbb13413-1f1d-4c30-9350-ad27e49f66b1", "value": "irannet.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43526889-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540149, "uuid": "e5a2555c-531c-4485-8347-9cd692558f5b", "comment": "Malware payload (Mirai)", "value": "6e324dbfc6addfc7481a2946ce009731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540149, "uuid": "50b23621-32ca-43eb-8e16-26ca6c0e606a", "comment": "Malware payload (Mirai)", "value": "73bcb8ae8eb933aaacadc4188d7b66217978966ae079b53d6270def21db5ab68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540149, "uuid": "8b02357e-b857-4113-9527-2f984da16f82", "comment": "Malware payload (Mirai)", "value": "6ddf0352bcdf5b0740bf40edad02fa5b89ac4c9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540149, "uuid": "ea25cc05-fb32-4f00-a019-445623796f49", "comment": "Malware payload (Mirai)", "value": "d44e7bc19e222d713cf96abe19025559046cf85aa508f9ac1f0165dec146a0670b7688e1944f8c93dacae89a3a1aeca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540149, "uuid": "8d2495ea-7be7-433a-84dc-93729b2d2d72", "value": "T166336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540149, "uuid": "3f633119-0f5a-4a16-b3d8-3d242b328fa7", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540149, "uuid": "ed18a33e-72cc-4dc6-94c7-34574abfc0b4", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540149, "uuid": "9c08fd80-3219-4abd-b387-612bb1237f5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540149, "uuid": "de969fb2-8a70-41aa-8d9a-1322fd7acc2d", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67322546-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468053, "uuid": "83f4a6fa-184a-41a2-9d09-245f7e4cee31", "comment": "Malware payload (Mirai)", "value": "ebbc0bbd6c2e4d700115e398dbae205d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468053, "uuid": "be37b31b-4b7d-489f-9c6d-69be493937aa", "comment": "Malware payload (Mirai)", "value": "7447fcd33946aa9bac48e645c87c908306b0c6538e10059117f0dc81c087ad2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468053, "uuid": "6b5ae2b5-041f-4bc0-b68a-0ea5e9de6e03", "comment": "Malware payload (Mirai)", "value": "3c6c39234efc6aeae6de6c68bf94b7aa0e4955f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468053, "uuid": "14e81e3b-7131-4aaf-b28b-2faeda888e18", "comment": "Malware payload (Mirai)", "value": "ce434306d5706416c480b97d17934457970747673c310aa3f9d78beddbc9df179738326d816085eb96929063c05c3a12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468053, "uuid": "c6028e22-1981-4099-b294-081d5c6a6e7f", "value": "T13B5302468B5F80D2D37136B7E451EB07D64C5EB802FB7C2B9B0289EC99F54C69220DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468053, "uuid": "df64626b-62ce-441c-bfaf-74f79ae85380", "value": "1536:L/yDmMQJuZRw/tDv/hWDntZWf31L3DcCJaFswOtKu+kLN:biH1ZRw1bAtC1fcSaFsbUkLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468053, "uuid": "fd2293f1-d892-4e5b-a880-731f1ce41d74", "value": 62552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468053, "uuid": "540934e7-07b9-405d-b25a-1ad5406036f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468053, "uuid": "bfb5debd-a13a-4749-abbe-c4b403dcd2dd", "value": "irannet.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e2cdaa-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468187, "uuid": "ff248e6b-44d2-4449-91a7-300ca9ca2376", "comment": "Malware payload", "value": "7604015653c3acc8c711b2d5c9161318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468187, "uuid": "62d77d73-05cf-40b5-b888-493b590765d1", "comment": "Malware payload", "value": "7469dee5a6679cd1b1293c38a1ed1c7800381936df68c87739786541f607ba60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468187, "uuid": "942956f0-9e71-4acd-840b-61ce1bfa9095", "comment": "Malware payload", "value": "5b3551b990147ae5ce112d0ed5587ab9030aa04b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468187, "uuid": "134821f7-32d3-49fa-b3e2-d9bc880df73d", "comment": "Malware payload", "value": "12e909f6d45fc5b91df449857eb37981e4bfcc31cfedae25e9b37f9faa64d0a90fc77fba997b64feef216d0ebac6e998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468187, "uuid": "85063396-61ef-424e-9090-478d24dcb501", "value": "T15C7533B383C05164C2456F9E919C4787E50BA95E6CA03C5FEC12DAA0B57733FBA211FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468187, "uuid": "a54abee8-b77e-47c6-ae37-df57364a6fc3", "value": "24576:NX1GTAUogoGmMDF2762AjSNSjsUTW92JWdXZZKiO3dVFf9xUYm7Lvz1CSOlgusHE:NlGTC6va7k62JcJkn3dVZQj7Lb18eX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468187, "uuid": "f5598d48-a960-4d9a-af84-e332c04fe050", "value": 1639216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468187, "uuid": "47043306-bf5e-49ca-847c-31943ed92f4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468187, "uuid": "c2f59a82-66e5-4e36-b2c2-eb3cbd6a0cf4", "value": "bizy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f474e4d3-ce42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544741, "uuid": "4225e3ff-3968-43fe-8dca-1caffa45e88d", "comment": "Malware payload (Mirai)", "value": "6b6c069026efce1a778dbee7e3aed6a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544741, "uuid": "67294047-1e55-4722-80eb-9edd7c4d0647", "comment": "Malware payload (Mirai)", "value": "75515eb5158a1a2aac72c992e341e1d2d83efad8b346151d4592dbaa41fa25a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544741, "uuid": "cf1febc1-10d5-496f-869b-4e8f15b83f2a", "comment": "Malware payload (Mirai)", "value": "63909be280f549cca21a9e2b352c4017163618a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544741, "uuid": "004bcf7f-f320-41ce-b95a-19e4e274fa61", "comment": "Malware payload (Mirai)", "value": "03808feb7b0178738bc2fac6adcbb8590d976717d8d2963236fc88c3aeef21641e055c04339109baac3ccf8021916a67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544741, "uuid": "f9be3207-b7e3-461b-9bcf-943cc344ca87", "value": "T16A230212AAF4EBC2D837E0B91D713B4F0C4DD1A264294DF2CA6675774B82F232671785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544741, "uuid": "a19ebbaf-e179-4a21-9d8c-fc264a69013c", "value": "768:LIinmP2YwITjZDXL0LlHwWNE7IEvE/mir7Z8kFV4XDxvKMMVtrvFaCzZ9UO3ttn0:LcjLpLgPULCmirV8kFGDxvKBxaoZ9Nde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544741, "uuid": "77db6d6b-9293-4bf1-9a36-41afe3d559f4", "value": 47312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544741, "uuid": "230dfaaa-850f-4d4a-ac50-92baf78fbd66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544741, "uuid": "2e36f297-5943-43d5-b214-478e6d81f042", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522e1778-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494217, "uuid": "dac90bf8-8b8f-4aa4-9e2b-d95a2d558d19", "comment": "Malware payload (Mirai)", "value": "ee6748968b650d5fe4f0969be601ff25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494217, "uuid": "a3814fbf-3922-43ab-9d98-c5fe8434930d", "comment": "Malware payload (Mirai)", "value": "75bb4c0200719b86a53be8b00dd65444023dfecfa50e250e1b357dbdf45d7973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494217, "uuid": "205d66d9-3850-46f8-90eb-b009aa073813", "comment": "Malware payload (Mirai)", "value": "1a45617dfd419b452557888e0e225b23d0469d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494217, "uuid": "573400a3-7568-448c-942d-5295dac1e1dc", "comment": "Malware payload (Mirai)", "value": "293a61fe393145f80577682c4ec2bc14b12a04d42db8d91e6eec2cf4ee6cc5b91e07486a6ace98e191b39f2ca667dc83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494217, "uuid": "8ce4d5b1-e934-4c89-854a-e04aa72a852b", "value": "T13E23F15AD2F1233CD429633868BE668668C0F55A63D409233ED4608DB8ED7E16B5DC63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494217, "uuid": "44feaad7-889c-4619-b2f0-6e21608deea3", "value": "768:JessG0aMqhczBPPoy3YWX/RJOHXkRMscGQaUdhBMfn2VinbcuyD7UoQRj2:JessLD556HXbayapnouy8oy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494217, "uuid": "6360672d-a7cb-404f-a73c-4fd7960338da", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494217, "uuid": "565b5656-97a1-4ebf-87bd-f09184d686bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494217, "uuid": "31bd7adb-ca4e-43d8-ae2b-1b62a479b0fa", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d504ca9-cda7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764477888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764477888, "uuid": "c0df7ff7-2987-471f-b95b-aa5e8e5802f4", "comment": "Malware payload (Mirai)", "value": "f007c763ba7bd3f044e639774632bedb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764477888, "uuid": "3f211f21-603d-4c66-a741-04194fbb23f5", "comment": "Malware payload (Mirai)", "value": "760705c3e7b208c1bd4c952c67e371052ab4752a7eaebbd991b6a45255541eb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764477888, "uuid": "9dc98676-4bb8-4e25-a667-b51fb3bbd830", "comment": "Malware payload (Mirai)", "value": "78fdf79d0e01411a54c264c36beb35149bdd3b0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764477888, "uuid": "df3499a0-ee12-4cb6-802e-c86d24486a66", "comment": "Malware payload (Mirai)", "value": "528bdc765cd7af41f61684bce0a10ac27507e91438e7490ec431a963e660a76f1a59e6019ee5b82f9ab4855175e52fbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764477888, "uuid": "5e99a6f9-245e-4d87-9bbb-d4dd454432ca", "value": "T147438EA3C56EADA4C15856B8E8308EB51F13F210D2A22FFB5A45C5A54043EBDF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764477888, "uuid": "932c7d7f-43cf-4d3a-9d07-bca1f9380ab4", "value": "1536:ra3NwtyODn3PS1v6hAGfegkUHR56H0mjF6ClUug7R:ri2D/o8HD6vF6Fug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764477888, "uuid": "d34f4ecd-06c4-4fc2-b3e9-ab2705007e06", "value": 55364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764477888, "uuid": "5bb6cb79-413d-4364-88a6-dafbdb1f5747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764477888, "uuid": "6349ffc4-7a8c-4bdd-9d12-2632e8d58542", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3230196-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468181, "uuid": "d6fb96dd-34e7-4b28-8a13-5a9529f5b76c", "comment": "Malware payload", "value": "acd074af3bc77ea1e73a2f024f3da8e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468181, "uuid": "ccda1dd2-bc39-47d9-9ad8-4235d10663fc", "comment": "Malware payload", "value": "766a44d44822cfbb7f163219868b8f08f6654acd3a386a7d7fc52ecd9924fef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468181, "uuid": "dfc72090-106d-4806-b7d4-c6d7500df985", "comment": "Malware payload", "value": "9c199c88e534800d2c56e284f7129a70fe92c15d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468181, "uuid": "ee28321e-78e5-4a3a-b2e8-f0fc30dd76d8", "comment": "Malware payload", "value": "6c10b580aeb4d0261a54bf5efbfbdf01a9120c1c9061ad11a2b0ff1cee6df259ecf354146c068211ed068810eb54abd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468181, "uuid": "33712e84-80bc-40c8-ae3d-1e04e4d5ce3e", "value": "T1D6753338E400FBFF7FC93F9936C54294925152265C78B1067C0C6ED14275EABCE26BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468181, "uuid": "4c5d3dcb-4f46-42b4-8b80-1eef827d95eb", "value": "49152:afwcQ7nCEUfEV2tpPbT0wYUV+2gm6wM7XkV/:k2AEotpPK+6JDY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468181, "uuid": "3a4b114a-1735-4a95-9e9d-0f01d5a6f65d", "value": 1618340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468181, "uuid": "1dbb16aa-3554-4424-9f17-fc53afa6b575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468181, "uuid": "2584e20f-a1f6-4786-9285-f14d4a744a21", "value": "bizy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d735d68a-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468241, "uuid": "c31b71cb-384f-4b12-a93a-0e0ba4f37086", "comment": "Malware payload", "value": "5dfdb79a596dcdd875892e5aaf2e6427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468241, "uuid": "51f37892-1bd2-4a70-ae54-0bbc54cd8d11", "comment": "Malware payload", "value": "76ce10d29cb369c3a1da47a29e7ee0af5f440d355209f9b1f394616b8019ef3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468241, "uuid": "ffeaacc9-d473-4bfe-b04a-6b5ca454c4d4", "comment": "Malware payload", "value": "6606476997e9b0aeb2fd6de220bfeb6e11118a75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468241, "uuid": "23304aa2-f4cf-4dc5-9dbf-9c72168a14fd", "comment": "Malware payload", "value": "8a584e8bd68ac763218d125de60981b8478a93ad4d4e86c4e03eb0cb5fc911ef75d6a31ecac6e9f7092629fc8522e4c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468241, "uuid": "2ce72002-d970-4771-99da-9b3fe45f85a1", "value": "T14E163A10FECB14F6E9431E3115ABB22F63319D094F24EBA7EA947F29F9776950832109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468241, "uuid": "7506129a-d8d3-4f08-b515-77785fa7bcf7", "value": "49152:ETrCJErSj9v7SYheJ/ayeeGFdir+JEGZVr5EI:YWJ1pLheEyeJJpZnEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468241, "uuid": "3751595d-43bb-4c10-9ac3-e20ea626ebc5", "value": 4042936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468241, "uuid": "6cca600d-e5f5-4fb7-9a63-d53e9b6cc280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468241, "uuid": "0839b65e-22a7-46a0-9d94-d0e060c8de46", "value": "bizy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b0eabd-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494215, "uuid": "ad96c943-499d-44c0-8b85-68bee94b6093", "comment": "Malware payload (Mirai)", "value": "55c7f7bdc4724717221e9053b3036fd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494215, "uuid": "2b8834cc-810b-4b93-a166-0e70a887f57c", "comment": "Malware payload (Mirai)", "value": "7706a544f25e578b68935598e152b6e75c7795665e6b92cc48cecd7add6d0487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494215, "uuid": "67cbfff3-f674-4298-8e53-f1f6f31179f3", "comment": "Malware payload (Mirai)", "value": "f9d863bf44a49bcaacaf751a9bd1ec7e8c18bf47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494215, "uuid": "48d04514-748e-428f-9d49-756eeabf581e", "comment": "Malware payload (Mirai)", "value": "4c111b18f4c81d28e14a022c9e0478d0cdbbd30235d6b675b308130d885157370eb64b4aad5036270dc5fd001e998f06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494215, "uuid": "bd760106-4ddb-417e-aa4e-9335d8d67154", "value": "T198A2E1A6E3D3DA71C6608935EFBC88926ED0CBB9F3F730B31021819621C1E9656F91D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494215, "uuid": "59da73eb-856e-4826-be5f-814685f65b8b", "value": "384:MOTec4Qq28dNSrGxwmI+mCsOWbckgtUdyismYi2jvahymdGUop5hXs:MOizQq28CrGxKCP/ky68is3UozJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494215, "uuid": "3d5915bc-869a-4984-863e-6b47b4d3fff9", "value": 22244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494215, "uuid": "10e74df9-f4a9-45b1-97b9-19916955dbaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494215, "uuid": "ae0165aa-6952-49fa-9e55-149f909d0492", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475a48a5-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540155, "uuid": "84899059-5f2a-437d-8ae8-84c569ae4196", "comment": "Malware payload (Mirai)", "value": "67df134a69e18027be58842b93021ebf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540155, "uuid": "53fd3d7d-5007-4e96-a877-c294a2dfabe0", "comment": "Malware payload (Mirai)", "value": "777c01dfcdb67cfa40a860b864273d5f391c2e728b6f8ffea43e5d24914c9834", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540155, "uuid": "b21c918f-d4f3-4993-89fc-bbee3c2c774c", "comment": "Malware payload (Mirai)", "value": "77d341414536e9d3a79559ec872229ad81ad1424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540155, "uuid": "d73212e1-3b02-4a25-985e-a0c395bae620", "comment": "Malware payload (Mirai)", "value": "2b68a71763889bf15dd4cc94f97623db9f277cda6c09ca966f15ac7ed3e9fa2279a1d3e5c4939268ae21e7c0b082106c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540155, "uuid": "4b7d2ab8-7320-4e81-ac04-194bf1103c10", "value": "T1E983D815BB510FB7DC6FCD3706E91B0634CC968622E87B3A7534D828B64B24B59E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540155, "uuid": "624b9316-d2f3-4080-9f05-81e7013bbbe8", "value": "1536:ewrswtaa15jJmYwPchJthtZxgSj394kIGWsd:ewrsw8aSchJ3tqHGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540155, "uuid": "ae0315c9-070f-4df8-b7ad-e0cf413bb685", "value": 81688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540155, "uuid": "be8fd429-b736-44f5-8ead-4668c063f70e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540155, "uuid": "1a4324d0-200d-4530-ba23-c5af313107fa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65714e88-cdfe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764515295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764515295, "uuid": "7dadb0da-7e6e-4f96-9e78-16c966150290", "comment": "Malware payload (Mirai)", "value": "2884a7ba1050168e6a66605b3872da83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764515295, "uuid": "9bd17c97-d6c3-449e-a075-8eb31152faae", "comment": "Malware payload (Mirai)", "value": "782186e1960a5372d08e26e42d90b627b892910c5c9c435802961b9af6e3089a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764515295, "uuid": "a7db9e53-620d-4c87-92a4-cd56a0ea4ffb", "comment": "Malware payload (Mirai)", "value": "9d790dc2b6b0c348bab6e825d2b52f3dd3aba80d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764515295, "uuid": "e149eeb2-2ec1-4949-a9c4-7cb9641a5ad2", "comment": "Malware payload (Mirai)", "value": "2d3e998af8a2e00282b31bd6a518c7ff179a6a98b58aa2f3bbd2bcbe5ea4587528d7d39e5e9238dd40a5bb190cca499f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764515295, "uuid": "0bde95ea-3879-4b16-b50e-de65f378bf65", "value": "T124F3B50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764515295, "uuid": "e7af3473-463c-43aa-b81c-47183a282e15", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwG:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764515295, "uuid": "23603cb5-dddb-4ea5-93ce-a729f1e4e0a6", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764515295, "uuid": "958422f7-657b-4457-8931-c32fffd7c7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764515295, "uuid": "1a8b8dc5-98ec-4061-9152-1dca7a2fd767", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3336697-cde5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764504769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504769, "uuid": "4f421278-e6b4-40cc-8466-4723ae12c446", "comment": "Malware payload", "value": "b9f5b78aa3d83369e816cdd3d1ebe945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Proxyware.DigitalPulse", "colour": "#985F9D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Proxyware", "colour": "#CFFC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504769, "uuid": "e16cc343-481f-4bbd-8326-d90c3e23167c", "comment": "Malware payload", "value": "7838dec8c61365b8c62197a842d540d76fddcc8008a88abe5477c60c16b8fbab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Proxyware.DigitalPulse", "colour": "#985F9D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Proxyware", "colour": "#CFFC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504769, "uuid": "7f4c04e7-ec9e-4be7-bc13-835122df021a", "comment": "Malware payload", "value": "d395dcf8fa0f2f954b14da87b504519f4f1d81e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Proxyware.DigitalPulse", "colour": "#985F9D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Proxyware", "colour": "#CFFC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504769, "uuid": "dfaea27a-5295-4c96-bc52-e1e847245743", "comment": "Malware payload", "value": "b789bfa8c17d6db60df2f156a28eca76c3822ca9d54869c902a7e2396fb35acdaf0455f2e24f31563c3f7bb5544a1651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Proxyware.DigitalPulse", "colour": "#985F9D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Proxyware", "colour": "#CFFC52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504769, "uuid": "4e0f3e18-1387-4ee2-87b3-e43834119a2d", "value": "T1F8B63943ECA545A5C1EDD13489768263BB71BC484B3523D72B60F7283F72BE0AAB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504769, "uuid": "1fc33f54-b629-45ec-935a-cc1d36c1f204", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504769, "uuid": "f98c00fd-cd70-4661-ac55-f1812bdcd924", "value": "98304:gViKGJNhwrC4sc0s9u7aHzpuxFcL175zEm6elQQIBpxSBJk+MRC+:yRm8C4sc0s9uO9OFcLbgm6elVI2wRC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764504769, "uuid": "671ce632-e393-4c9b-980f-e8e0d6325fe6", "value": 10996816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764504769, "uuid": "bb0af675-e8da-4676-8abe-117d288e3e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504769, "uuid": "86163c01-bd5b-4b2f-98d4-675fc52ed6ce", "value": "ntservice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dcd822-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540151, "uuid": "e610afc6-c5bf-444d-bbf3-61cb3c1ca31c", "comment": "Malware payload (Mirai)", "value": "37c2e3645e6c73ea551f3920cbd0c793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540151, "uuid": "cdcbaa79-d577-41f6-b26f-16bf88c9fc63", "comment": "Malware payload (Mirai)", "value": "78670577374061d1a30cfb1eead23cbf60b1e80c19072dacfb1721c306761592", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540151, "uuid": "1789ff95-a44f-4e25-9a63-1048129798b5", "comment": "Malware payload (Mirai)", "value": "95db6498a6940ba0160c9ae0b10fdd4b7544cd95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540151, "uuid": "7f7ac5c2-1c2e-44a8-9253-db0985d9add2", "comment": "Malware payload (Mirai)", "value": "b9dddd9b2b6c1d7c0357dc5a6b5c8a481ce0e55297e8c5454e5d3d9dff99c948d34741ad540876e15e401a50d5014f47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540151, "uuid": "da4e3517-5ab1-44c4-8a20-6296e350c910", "value": "T102C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540151, "uuid": "a45e6f7c-ddc2-43c8-bdc2-f491c9eb50d4", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoqrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIqrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540151, "uuid": "677aec9e-f793-442e-be78-05964a64777b", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540151, "uuid": "cbec9664-760a-4cc6-a102-f9eb76672a91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540151, "uuid": "7efd773d-1f1a-4d2f-8051-96f0f91a45f0", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c81de4b-ce16-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764525588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525588, "uuid": "342bfa80-75d4-4a0e-a993-c14008895ae3", "comment": "Malware payload (ConnectWise)", "value": "2c6cae075cb4f8181b20f74e29c487c1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525588, "uuid": "8904ed8e-dc06-4bf6-93ca-50f0aee1520c", "comment": "Malware payload (ConnectWise)", "value": "79b7b84850095305eed56f15781ff75aa456593d84e558646db60249b28711e8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525588, "uuid": "429e2797-ea52-4dc4-aa78-ddd9cab745c7", "comment": "Malware payload (ConnectWise)", "value": "8bd49a4caffb4acbe3cdb08e16071f4f65be825b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525588, "uuid": "7ea7e71d-bfbb-4943-b395-7b2bbf350f0a", "comment": "Malware payload (ConnectWise)", "value": "b6c2e0b10bcc5959e890026a756bbfeaf7fade168669f9031e36b03646c0df96d9e114decba4ada07598cf97ded7d924", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525588, "uuid": "688c10f0-dff8-411f-b4ee-c024ed995b3b", "value": "T17AA6232523FD801AE8F75A7DED3682F45972BE64CF22C11E9328B90D2974D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525588, "uuid": "e4b7f695-2464-4121-92c8-0c9c3f4ec6e9", "value": "98304:/wJ4t1h0cG5FGJRPxow8O5wJ4t1h0cG5vwJ4t1h0cG5RwJ4t1h0cG5twJ4t1h0cW:4Wh0cGwMWh0cGCWh0cG4Wh0cG4Wh0cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764525588, "uuid": "763038fb-6e06-4554-8f75-8d8a1764cc1e", "value": 9912320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764525588, "uuid": "44ae3357-0f22-4690-8cea-667eacd98458", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525588, "uuid": "9a94a0e6-d246-486c-b14b-36a1953f1b08", "value": "crm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c3551c-cdb4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764483436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483436, "uuid": "e2bc3113-0e4f-418a-826e-4a6de3bc8c80", "comment": "Malware payload (Mirai)", "value": "c5da5e486a99152339edc1842d62a206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483436, "uuid": "d3503b47-1c78-4f2f-9672-56c0d982890b", "comment": "Malware payload (Mirai)", "value": "7a6139af7dca3c5e62d8a8db7430c7781da6d0138e5a21a3ddc66ae31fb9ec6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483436, "uuid": "b5c856a4-9818-4734-ab7f-9cf02623e45c", "comment": "Malware payload (Mirai)", "value": "696773e684b147a49f6d939181aa021898df1383", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483436, "uuid": "409a935b-be5b-4976-a86e-85506aa68838", "comment": "Malware payload (Mirai)", "value": "652ff332d52979441eadd09198a42c4cb0a52d813cbe55cad9ddeda3785499811eea32f05ceebdea13fa08cbdbf01ab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483436, "uuid": "ced47622-d931-4100-a7c0-a5bc61b6456c", "value": "T1FEE30845FC519B16C6C662BBFB8E428D772B1768D3EE3103DD256F20378B96A0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483436, "uuid": "d3c7451a-7869-497b-a22a-b002b1059575", "value": "3072:7P4gydYSMF+5U+u55taXunFl46SZecNTCzjodf9FeE+R:7gfdYSMF+5UPtS+Fl46OecNWzjC1FeEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764483436, "uuid": "f5f5aa23-049e-4f31-9253-cfc1d5c62231", "value": 152408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764483436, "uuid": "dff29b1f-39d1-414c-8abe-80fbe03c24df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483436, "uuid": "0328a997-5e34-4dd1-9e4c-1dfade0a99f2", "value": "irannet.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb17fa65-cdbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764487092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764487092, "uuid": "306d4880-e87f-4e92-b0cd-2e9f50e86666", "comment": "Malware payload (Vidar)", "value": "cf6bac31f27140e44561b61d9ed79080", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764487092, "uuid": "c54d75e0-f76a-45ae-b8cb-957b365b7c44", "comment": "Malware payload (Vidar)", "value": "7bab3fde16c87b9a1652cc87970499cce2ea5ab22a8a8804c870e904583dca88", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764487092, "uuid": "c2878abb-6590-49f8-9504-0ea5260e8520", "comment": "Malware payload (Vidar)", "value": "426ff83db9e52b42152d54323a135d95414dffef", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764487092, "uuid": "1a635540-9f51-4db2-8041-ac70ca159f89", "comment": "Malware payload (Vidar)", "value": "d68737235c22150f3d715593fe0b27fac947c797955578e7a53fa6ced7b0bc2a5b430891b6515e35138eb26ca18ba842", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764487092, "uuid": "36a6d91d-5631-4316-8f4f-e46144704f7a", "value": "T1EED57C677E908469D0EDE33689B652A2B725BC4C5B31A3C32F956A342E73BC05633F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764487092, "uuid": "70cc9a90-d60d-4c5d-aa69-da1d55831ae8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764487092, "uuid": "9c4ddec5-e69c-46df-bc19-4d2e630eaeb0", "value": "24576:POJY+kZ0K3JH80JgccIwRiTs2dmeG5R6VgKKMDieCTGEzscni55H628QQ:POLkZ7H80JgccI6iTsWNXitOdip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764487092, "uuid": "e74850f8-e798-49e9-9d0d-c7b4e740ed7f", "value": 2917592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764487092, "uuid": "b837c147-bdb0-4519-81ca-6f336ba21ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764487092, "uuid": "152b077e-15b1-44f5-bbc1-a2adbeafb155", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454cb1dd-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540152, "uuid": "623baa0d-9bcc-4ce8-a72a-bb1bed3b355d", "comment": "Malware payload (Mirai)", "value": "7636180c08eb0fff568d1834b2ffd497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540152, "uuid": "54a4cc1c-4c7f-4754-966e-dc5836d9c26b", "comment": "Malware payload (Mirai)", "value": "7bbaa5e3fb8e37ee722314148712c37279411a0bfc436a764ee62278a44beb32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540152, "uuid": "88ef8a10-ceee-4094-8b83-c3a670bb10a9", "comment": "Malware payload (Mirai)", "value": "0dbec5e5ed378e4eb8f1794b7d7c2b983bca39af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540152, "uuid": "ba4ddb8d-0e65-45cd-ba5b-fd183c7ae157", "comment": "Malware payload (Mirai)", "value": "a3f0c5c1819fe5edffac72d4918e7aba8bd2b7f73b921c01205a377a6a20e66433b6b9fafdfe68da648a575e17a03a3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540152, "uuid": "4e81ca61-a237-47be-ade5-0a5fc817308d", "value": "T1CA633BDAF801DD7DF90BD77B4457090AB530A3D502831B3E63A7B9A3BC721A91922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540152, "uuid": "82de8eec-1229-4722-8af3-753258a84170", "value": "1536:3KHzwx3Fut1DweZV89f8y1+xD8iSdJ/SwoESzrQ2L:3KHM3QnMeZRy1YDhS/MzrfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540152, "uuid": "1c3a62cf-abfd-4d16-af48-62ab83a8b21c", "value": 68532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540152, "uuid": "f86005ce-cd2d-4007-b314-90e7e7c7d794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540152, "uuid": "71f572df-b316-46e8-b581-7820ef143282", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1175801c-cde9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764506135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506135, "uuid": "4131460e-0340-41c1-9a26-dc5fae4f0548", "comment": "Malware payload", "value": "8f32b1f714c6aac12db252249bd817dd", "object_relation": "md5", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy.Agent", "colour": "#098351", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506135, "uuid": "d525f03f-d100-42e6-a741-f901360af8cc", "comment": "Malware payload", "value": "7fc8cf43242044f1fc290e225d5a7c0235a17ad22710ef158f23a635966b2ca9", "object_relation": "sha256", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy.Agent", "colour": "#098351", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506135, "uuid": "2ccb795d-f544-4215-a164-004439042cbf", "comment": "Malware payload", "value": "31381b4e0b79c63c1566aec9d1c0ef72b0eccfb5", "object_relation": "sha1", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy.Agent", "colour": "#098351", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506135, "uuid": "3b0ec88a-fd7e-473d-9765-5daed83de8ac", "comment": "Malware payload", "value": "251ea3ce3efdbd5f2d321757430017a202e3c8236dce0271e95c11f05d4f3fe023c65f87db7808b1605db52de8a3f043", "object_relation": "sha3-384", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy.Agent", "colour": "#098351", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506135, "uuid": "c1a83c6c-95f6-4a13-8663-e1e0217682d7", "value": "T143A29D432B294753DF844BF960F6C113DCFEFA820FE95543B656D6280E24381FAA951E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506135, "uuid": "cc4f0216-bf52-4543-adf9-6cd8dd221d36", "value": "35d08068b500abfa3f5743e116fd74f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506135, "uuid": "626c3453-50e5-4e61-85e0-08e8f5bb3319", "value": "384:fmuIj7PuETBvQh1zjHEa0vPNS7wC6ki2XWIi15BAS+ShjmM6IGBkSUV:c72ETBvC/Q6wt2Xa1TAS+ST6nkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764506135, "uuid": "aa1a895c-51a2-4545-8e2b-483da729827a", "value": 22200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764506135, "uuid": "03eb17aa-24bf-41ed-a6bc-97d46d449a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506135, "uuid": "adf84c3d-1133-41fb-814c-eddaf48d2b82", "value": "sdkhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516c2811-cdeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764507101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507101, "uuid": "9b212551-df62-4173-b680-876b9b761863", "comment": "Malware payload (Vidar)", "value": "d0d3f6f7466c2e7cc2d48dabc6d40eaa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507101, "uuid": "a13bb5c4-80a5-4caf-9f94-778bb5320614", "comment": "Malware payload (Vidar)", "value": "7fe019ab2f62bb08faf7cc6969eaf2a9d35f93920c66a28297afd6851e0ad9c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507101, "uuid": "75fcc11d-6028-4f0e-b397-822cfb8e4d71", "comment": "Malware payload (Vidar)", "value": "f3e2cbe390ce3a4bc8a5f7bfcd375ae3cae388c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507101, "uuid": "cddc308b-2a60-4465-9105-aa771a772ffe", "comment": "Malware payload (Vidar)", "value": "26391559452fb7602dcfb6d26fcbc8f3db8025a771f3a1a3a37cfd95b78ea05f17030442a2edd5b180d2ee86abdc1a8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507101, "uuid": "e7e275ed-ec26-4129-9a8e-62d7233f1943", "value": "T17046290AAA91CE46C59AD2F8FDA3A1817370BC5D077126C34B4261363FBB7C45A36F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507101, "uuid": "26da1b9c-7de2-496d-9ceb-54166baad66a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507101, "uuid": "39e6abed-ab9d-4b14-893d-32ca5ccc35fd", "value": "98304:NwIZ/2cifyorHE9oEZJ7HqLPUBZ+nA6oa:NrZ/2lrHESwJL+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764507101, "uuid": "ae7fbd5d-c8b6-4300-b2fb-72721dbd2815", "value": 5405024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764507101, "uuid": "677ebb1a-a741-492f-9946-03b51e4f455f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507101, "uuid": "5caca6ed-127c-4e47-8e7d-b4aa8103f286", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a6b21d-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496726, "uuid": "39be7454-494a-4127-b900-4179c19b3878", "comment": "Malware payload (Mirai)", "value": "afa2f1b162b26ec4df1ebead95788921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496726, "uuid": "c4976436-5be2-4c52-a26e-5c8a2db6569d", "comment": "Malware payload (Mirai)", "value": "8092315b10ccb89b7d3a0847b7839d9ed145e9ff1e7c80f943624c1c42f74180", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496726, "uuid": "c06fbd86-6f2f-4538-920b-71ac5ad869c8", "comment": "Malware payload (Mirai)", "value": "af33c06ed0427711ae44b8d67b8bfbcbc3de2436", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496726, "uuid": "64a66cc2-ec89-4ee7-a1d9-39c255660ce1", "comment": "Malware payload (Mirai)", "value": "56941e43e663f8ebddc7413cbe7a7b268c07299075d9d823704924c8150f6fc583034ca3c4251b5790fe3e97d040fde5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496726, "uuid": "cfca45d3-07ae-4729-89e3-96cdb564e643", "value": "T17333F2A049DFF240E6301D3EB9AD8C0A2DD99BACD9F4B0B215944B811E4395D58B9FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496726, "uuid": "cedb846d-7ecf-4b75-a451-48789c975ce2", "value": "768:S44O4eyC217SuUTXZazr6s7PvQAdpakxue6+t0NGX06/OnhqolRRN1iZ20njShIX:SbdAsKU64hp1uGKsKR4M0IBg2nI0z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496726, "uuid": "e9aa1d7f-d8b3-4a34-bae4-3c1d179ddd72", "value": 53776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496726, "uuid": "9e193f8d-0aa3-4c03-aebf-427bbd8cf984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496726, "uuid": "a48d6cc9-ee00-488b-b9dd-b27c9fc1a8fd", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3528869c-cd87-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764464104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464104, "uuid": "6f84581a-db46-460b-8359-e137ca5ae6e6", "comment": "Malware payload (MaskGramStealer)", "value": "6b8403270c3fe9f011d9563a3993aca0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464104, "uuid": "0e1786b3-1646-407d-8c52-333d1b7ed376", "comment": "Malware payload (MaskGramStealer)", "value": "80f0f85273b34748075d94838f316625883daf5b68a02fa24489f91334921fb4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464104, "uuid": "47278a8b-3091-4efe-9998-2dfbe621fa69", "comment": "Malware payload (MaskGramStealer)", "value": "55a7a1b03cf478c09c2b8558408e6bc4d2b9a5a1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764464104, "uuid": "84945d8d-e4fe-4f85-a1eb-149a68f0d626", "comment": "Malware payload (MaskGramStealer)", "value": "56c824422bbae2840adb89ce93c2c42bdde1d8058599e587c6b42d38b231d38679baa727fd05abcd5e38815bda8f9d24", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464104, "uuid": "39e63612-8ed7-4fc9-8595-f6bbf890b462", "value": "T13BC502212F3DEB20E1E5E4F8B5257344DC69FD220BFDE979A0513AA244BAFD26D59003", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464104, "uuid": "8e346a25-64d6-40a0-b81a-633b80c2a3dc", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464104, "uuid": "005a3e78-ffec-44fa-b469-342a085afb4b", "value": "49152:FryArpYhH/TTMa3MY/4zbrFWmUl0JxqM9/6Ul77OE7OnCGsp:ppYhbI6l4zbrFZdjl77N93p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764464104, "uuid": "db13bad3-fd91-4486-a7e9-798b431052f6", "value": 2588160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764464104, "uuid": "7dce84da-7c34-4a1f-a6ec-90e0fc0b194f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764464104, "uuid": "4e503be1-6f96-4ced-86ae-bdc31fc0f0f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c745b60-cdeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764507120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507120, "uuid": "eda87c71-878b-4177-adef-1205d17d92f6", "comment": "Malware payload (Socks5Systemz)", "value": "94c66e17535c99e27499321f9e538af4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507120, "uuid": "ef87129b-67df-43df-a2f3-2ff74dae87ac", "comment": "Malware payload (Socks5Systemz)", "value": "8165d04a805f706ca080d48a4bd747752f38b42f8388ad9d1641a72903f18c89", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507120, "uuid": "bb5bf189-c688-4824-904c-7262bc6c1288", "comment": "Malware payload (Socks5Systemz)", "value": "35bc9a3936ace591fb7003ae9fc5daef215f56fb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507120, "uuid": "9e7d8ce1-313f-46e5-b26c-3e228d0745cf", "comment": "Malware payload (Socks5Systemz)", "value": "e7f6aa62262b96590950df9206fb0b9fffab659c011bb49bc9fd5348d7714c8c9812223eee4ae37d4480e9a551895b9f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507120, "uuid": "2bd2560e-5b90-4345-b4d3-ebd30ab67184", "value": "T19206339045D3C830EE10B736AC7425604E67766F8E3933A6B29ECC94FF7E446A0497B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507120, "uuid": "b8e3d135-4f5b-43a1-91a9-7e80daa4dca1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507120, "uuid": "09cb182b-86a4-4353-a49f-896aba5dd20b", "value": "98304:MCL62NbdAkjQCVBvyaj0qZJzgbch1v+ID4qOQs:362NbdA+QMyeZJzgbuJ/Dv7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764507120, "uuid": "a47f7014-3241-42ab-83ad-87df720285ad", "value": 3878855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764507120, "uuid": "b2df5769-77f0-44b8-98a6-2e4b7a416f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507120, "uuid": "ed9a61c0-959d-4784-8a4f-1f3815f4cd63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6ccfa5-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538800, "uuid": "e4299a35-58c2-4863-9701-c8902c7af88d", "comment": "Malware payload (Mirai)", "value": "44244d3ee38ed9c90c8a78ab9a28a7d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538800, "uuid": "d06b3133-8244-4305-9185-a0e710650086", "comment": "Malware payload (Mirai)", "value": "81a7f18133131f4f2821b29b16562bc9cfe36a08ac03dc011e99b8213301ed38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538800, "uuid": "475b0786-fcc2-4367-8a3b-84cc32424904", "comment": "Malware payload (Mirai)", "value": "65dbbf51b1721909f86e74836b6159a9ae843800", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538800, "uuid": "89151a51-bd7f-4607-a96f-4890057b9eaf", "comment": "Malware payload (Mirai)", "value": "0c8aa2fe20137649238d02a318c902c6a2bc6d20907ec5ecbaf41135a76955e26f30bca10e49adeab0eda48afdf51ed8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538800, "uuid": "0c44c4df-f453-41d3-8a1b-88636a011fea", "value": "T180C3AE32D8396DC4C1A45434F8B1EE711F61A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538800, "uuid": "022641e3-1f28-41ab-96a1-cb7995673bd7", "value": "1536:qaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKRZwGQaX4jnOsKigXIQSUwrVr1vwd:qf5Z5Z98XdmVMJaQaX7ziGSUGfIwEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538800, "uuid": "f31fef69-080f-4fcc-8ef0-37a89352821d", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538800, "uuid": "bfb6cbe2-fa9b-4e31-9182-94ba940e374f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538800, "uuid": "803cc90f-22bc-4b00-8d8f-46edca1889dc", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aba9d2e-cde5-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764504620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504620, "uuid": "651e7fdf-41b3-42d7-94b8-c451d42a48ce", "comment": "Malware payload (MaskGramStealer)", "value": "db2d94edc5a6aeb988162109787a6bf3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "SvitStealer", "colour": "#0E6C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504620, "uuid": "7c055cc3-8bb7-4d97-ad08-c065310cbe24", "comment": "Malware payload (MaskGramStealer)", "value": "8224b9c14404d8e8bf74221033466ac4ea33551b92914352be9c0ba92ffbfd43", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "SvitStealer", "colour": "#0E6C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504620, "uuid": "65a5fe29-8950-4771-a4f1-125fd2d0ac58", "comment": "Malware payload (MaskGramStealer)", "value": "f97703ff0c8680e029fd34c4944e533c59f49a52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "SvitStealer", "colour": "#0E6C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504620, "uuid": "fbb3da09-8ab5-4216-85e3-0c985d782542", "comment": "Malware payload (MaskGramStealer)", "value": "a12f0e4a525ad4dcecc18b93d4dc22535ad5656e06db87e0160a24fbbb37893acae8a34749a8ba378ad8161159a63d72", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "SvitStealer", "colour": "#0E6C2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504620, "uuid": "a6969d59-f1b9-4062-8431-dc8c53859a75", "value": "T153F3E0BE49F9E34FF2ECBCF1E0159F91A810B15C5E656AB2993DD0B037329881A5D2D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504620, "uuid": "489b5a15-cc2a-40f7-b0f1-26db0284aa71", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504620, "uuid": "9f064ecd-abf5-4409-a147-80460683ccd9", "value": "3072:d8jGy2CLNyl09nRoD1k8913tlY7xHz8jDulR0D2NCIPSzh5EjKA:mLQl0/oR3tlYtISCIPSzhKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764504620, "uuid": "68b96e00-d743-475a-b234-18ebaa691148", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764504620, "uuid": "978c4b0e-0d64-4a3a-893c-e763a579a9eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504620, "uuid": "9b2bbf78-8d22-4259-923f-bfca5dd1e068", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce1e80e-cda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764476492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476492, "uuid": "89ad2bfc-42c4-4156-83b8-24581e4de64c", "comment": "Malware payload (Mirai)", "value": "8470805613759cff726bdd86c1e82b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476492, "uuid": "5d19aa25-c77d-4cce-bf7b-c4c64e7120d1", "comment": "Malware payload (Mirai)", "value": "829d6a7d2552d0675c67583b2ca5f387900014009acf5a8dbf0ce0fd2033cd18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476492, "uuid": "42798c2f-63e6-48fc-89e3-77639b5a0fc9", "comment": "Malware payload (Mirai)", "value": "103d31cc86ab2e01b2ab4203b83a8ba9e2743de2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476492, "uuid": "1019a08d-0099-4345-8ea7-7110cd94d03e", "comment": "Malware payload (Mirai)", "value": "aa04639fa94f8b81bf497777ce2ea33008be58aeab4b2c50fd8b072f95f66f101e7d291a0ca048e47eac2f530fa535f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476492, "uuid": "8afe04f0-d7a1-4de6-a666-223e27e4d673", "value": "T12D53F1B713BF6278C01159B8A56A8559F6F53B03C347A71B177631BF8D1C184A8A9348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476492, "uuid": "816402fe-97f6-48bb-ae94-8d80cfc395a7", "value": "1536:sBGWiSq4Ar1fmfOw1WViXJClpURWBS7NUSS2:JhfpOmKWVMkTkx7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764476492, "uuid": "3e90d49c-d721-4b34-b386-8fae43ee628e", "value": 62204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764476492, "uuid": "01161464-b3b5-40ef-9b9e-096bf4932d7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476492, "uuid": "2430bcd0-d18c-4088-94fd-84920c9e8257", "value": "SecuriteInfo.com.FileRepMalware.78696463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eb270c-ce42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544532, "uuid": "e3c95cce-e5b1-47e2-8e4c-4b959b43e8cb", "comment": "Malware payload (Mirai)", "value": "2060f26ce21d5d9b9d87e8655309b1ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544532, "uuid": "464e9eac-f5ab-4865-8082-164bb0ae0fab", "comment": "Malware payload (Mirai)", "value": "83ff5f3d8cd9432cd58527a50a4f4fc0f1d9736c8841bb29f1464ac8f63a411f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544532, "uuid": "1c5bd193-ddfc-4f4a-ac09-cae8ff84e1e9", "comment": "Malware payload (Mirai)", "value": "2cba0db0c8320789a99199fa1272a8e23bf88bea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544532, "uuid": "5ff10886-007b-44b1-9324-5f0042cc1ed1", "comment": "Malware payload (Mirai)", "value": "56587cbd21f025210e155430bcb3b287c05674159c51940efc96db38b0626a8b00a1f8ce5be6d63a8b198ca2caeafbc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544532, "uuid": "9d181515-dea4-49f9-80f1-f0797fd36eb1", "value": "T1E5C31986F9824A22D5D7127EF92E118E331317B8F3DE72129E245F2133C652B0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544532, "uuid": "77958c6d-5824-474d-9e1c-0406e50b41a6", "value": "3072:HDWrFoeatGA59WvP98nTma9uk4cIXEuNGtr:HDWJoztGA5c398niat4XEZtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544532, "uuid": "3681c77c-2bd3-41a9-bc60-a33380ac00ee", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544532, "uuid": "26f17c47-18f9-4f91-8ad8-b3445ec8556c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544532, "uuid": "40f7f3de-5e63-451b-8681-7325b36d0b52", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3b0e70-ce45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764545695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545695, "uuid": "1ef6e391-bcae-43d3-9777-f8c12fb21145", "comment": "Malware payload (Mirai)", "value": "6abb9b7c0a2d872f66647642a856266a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545695, "uuid": "e82aae3c-498f-4389-8e37-ea0504d99e3f", "comment": "Malware payload (Mirai)", "value": "8420f9106d0c6d9644cbeb63ebb3075ca8276c08cce0f3bbda46bafee22d14c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545695, "uuid": "7b022145-10dc-4acc-8193-c3ad84a81b6e", "comment": "Malware payload (Mirai)", "value": "523114aae62be6fd6bffd82295b28b84d7e6457c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545695, "uuid": "6debab3b-3523-4083-aede-782e8ffd7aba", "comment": "Malware payload (Mirai)", "value": "245cbdfcb54e561de64b9a7f25469d4189a0addcc9451c467efdb0dbbf8c9714e5ad6c7d0a86e7f5afc246ba02687c95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545695, "uuid": "81328c8b-d0b2-4634-9211-a3fabf83334f", "value": "T1F0D34851B9829A27C5D523BBFA6E028D332563E4D2DF72178C215F213BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545695, "uuid": "5fa90ec0-f566-46fa-b2c5-a8337a877d8e", "value": "3072:jfNCLnvF/iH4xNfgDayw9YNE0dWIJdHzFQup:jfNCbFNfgmyw9YNhnJVpQup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764545695, "uuid": "6880cc79-abde-4430-83fb-7d5e0ebf61cb", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764545695, "uuid": "efb8ad22-c29f-4393-ae95-953856c522df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545695, "uuid": "262a2bd9-6da0-48a5-86a0-4ae7cefe640b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0d77f4-cdf8-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764512837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512837, "uuid": "16ede068-a4fb-481b-b82b-dc9ea84ca082", "comment": "Malware payload (Vidar)", "value": "cacc58e25e2a85bfa716314e70057a93", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512837, "uuid": "67527430-e11c-46ac-89b6-8977107dbb80", "comment": "Malware payload (Vidar)", "value": "84a87bf89d8ecb9a801d477f81b288ee5fdabe48adf82b5608a92ede4a1c2304", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512837, "uuid": "c8aab7d5-9e53-4b68-8ce2-bb98b3d68e6b", "comment": "Malware payload (Vidar)", "value": "c5041b8e59371d8ba6bdf411fc4abc1b4dd6ec02", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764512837, "uuid": "28eda683-e8f7-4256-9c3b-7ec5f1a192af", "comment": "Malware payload (Vidar)", "value": "61091bd7a51d9767750fbbf0e75c9d19965608fb315b55f8d9598fe2cabfaa326ee8c05edb3a3aa3c22e7c566f9bf4a0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512837, "uuid": "ed1bfd2c-4a8c-4146-bdbb-e682d54ffef1", "value": "T1C275231273A264E9D1734238C4B26A26FB73B42617505EFF0390937DAE23AD1DE3A741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512837, "uuid": "8990e7f3-67db-4600-9834-52c96f3bd83c", "value": "00ec1f9addbab7dd7a563fe6fe9caf72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512837, "uuid": "3c8e79a5-bbb0-42e9-b900-51227364c40f", "value": "49152:cTqqQEzpRZROWFeREncVkWMe+NdP6H6ze:cWq3zpRZYH2ncVGe+fC6ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764512837, "uuid": "61e5ee70-a02c-4f93-bbe4-53886f391da2", "value": 1624321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764512837, "uuid": "f5f5825a-3eb8-4e87-b048-9accc9e95a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764512837, "uuid": "db69b92c-d636-4fe0-aec1-b2e86263cb9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ca9e7e-cdf2-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764509979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509979, "uuid": "9bd5ff23-8349-4f3a-a45c-471cd21892da", "comment": "Malware payload (Vidar)", "value": "0f0cdb04f0a8e89915138814f35150f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509979, "uuid": "552700e1-3e21-433f-a51c-a08651a75b0a", "comment": "Malware payload (Vidar)", "value": "8560107ed6d0bf85bf9d6b64d5ebac06c240174aaebdc280a815ce36694c579a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509979, "uuid": "14094b09-e9af-4791-a721-505f72866a4c", "comment": "Malware payload (Vidar)", "value": "c09f6d05e20f163a13be94e0f7932ee3f96f5dd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509979, "uuid": "e3f6b3fa-dcfe-480e-b5b9-2197cca7f9fd", "comment": "Malware payload (Vidar)", "value": "e88e62925071b88ff8dbd34a8d3fa83b32408c3ba20473d7777929d27edb2c167eb39322b012525a0b88d3c5f349352b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509979, "uuid": "11f421f1-f6b1-4d87-b5a9-6712c1f35c3b", "value": "T13336293E79858A98D05AF238A993718176B07C180B7167E34A94FE792E7B3C40D77F18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509979, "uuid": "26c0611d-86dc-40fa-aa3b-522965b361ec", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509979, "uuid": "c9cf083f-0451-406f-8087-6f7e494d1d1e", "value": "49152:BTdAKmHP2MgrjZo/8cYZl/16omyFqruZl+/U9DVbb4e0W3EuNEvnB4H4Xv0kymso:ByeZjZoNYFWhqnwt+9OScqSRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764509979, "uuid": "b95b49d6-0c33-450d-bd22-f6576b350050", "value": 5061784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764509979, "uuid": "0432f02f-0d35-4ab4-8a85-f2cb6051a406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509979, "uuid": "3b0cc8e5-4213-4069-832e-e046bf808799", "value": "S\u0435t_u\u0440[U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dd545d-cda3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764476099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476099, "uuid": "4ec563e1-956c-4314-9e99-ead9657562db", "comment": "Malware payload (Mirai)", "value": "3ba4d5e0cf0557f03ee5a97a2de56511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476099, "uuid": "2beda219-2569-4db1-ad46-b86c1dc5a0c6", "comment": "Malware payload (Mirai)", "value": "858874057e3df990ccd7958a38936545938630410bde0c0c4b116f92733b1ddb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476099, "uuid": "6576151f-5cf6-47a1-b608-a8926c38c3f8", "comment": "Malware payload (Mirai)", "value": "dc057522e04f37a6143cf6ce9b5d4a19aab8ef7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476099, "uuid": "149723ca-2589-4daa-852d-eb9f75c121a5", "comment": "Malware payload (Mirai)", "value": "aa5b3c419df8574a3b275c138fe00f4f8a3b0cbbdb2e8de6fe19f4799606378dd501dcd2bf63efe260733267c8bc9070", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476099, "uuid": "f3a73510-fd34-4029-8f55-61a5b1163af5", "value": "T11933F123B7E4CC56E04071BD0DCB9C25DB65A60F66E0B0FC61DC15E3BA94A5D39881DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476099, "uuid": "a06106bc-eb56-4392-a430-af622144d7db", "value": "1536:cwESezjYz+Fuxg7jPpPH20GLslTJN/Kn4nouy88:cw48x0PtcoPN/Knwout8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764476099, "uuid": "44ad0896-99ae-484e-9845-07bde4cb3bda", "value": 50552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764476099, "uuid": "59d0f622-ac5b-489b-8766-1b04b2a8f7f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476099, "uuid": "281d7a7e-f47a-4a4b-bd25-7631f356d812", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9410353-ce3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764541259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541259, "uuid": "8949d245-bcfa-4da2-92e0-0c696526293c", "comment": "Malware payload", "value": "89ae9fd1c28c52e7d8365acfb970a0ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541259, "uuid": "80321fd3-daad-446c-a3eb-e4cb51427570", "comment": "Malware payload", "value": "86f8c01601b1d3fc882b4e97fe12e86c247a15be4a52786badfc535de1bad912", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541259, "uuid": "c0c3121b-51c2-42f5-86bc-dd238ea8b76e", "comment": "Malware payload", "value": "84aaeb2aa6cef11578aee33ee9dfb7664d8db496", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541259, "uuid": "f597934b-76eb-40df-bc3a-eb83f517ba52", "comment": "Malware payload", "value": "17dce2db4870cff55de6b488ca9ecfeaf464d4c78d4820112b98ec1cfaec2a0d57534dea58530aa68736aea8eafd498b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541259, "uuid": "f1142d24-bfac-4a41-99cd-1c30cff178b5", "value": "T1FA11A4EF0151145A2540FE99BBA3CA2AB08DE5CB2CD68F5C6CED0C3510AB91DF815FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541259, "uuid": "78e70044-7d89-4f39-af81-f9033d29365d", "value": "24:tfYZIBWvHkHOWv0+WvRnRhWv0IBWvGUWvYDYdWNSdTWz:tfYZIBWvEuWv0+Wv17WvHBWvGUWvYDYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764541259, "uuid": "3a4dd335-36da-4e50-8828-9175ef3738a3", "value": 1011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764541259, "uuid": "01debb73-812c-4251-ae0c-de8f246f0a61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541259, "uuid": "cfdb6397-cc50-4ac4-902a-75b11b3687ad", "value": "lilin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24714699-cdb4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764483403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483403, "uuid": "1f975d09-a3d8-4663-b365-4d0ad38f833c", "comment": "Malware payload (Mirai)", "value": "995f2980c6f8dcb140e7d5c5f0ad6bd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483403, "uuid": "316ebaee-602e-4042-b5ea-bc6efbc24dc3", "comment": "Malware payload (Mirai)", "value": "8704e88601ef5f71f2843dacbf7d373c9de68abce5f6961009e86cdc7dbb8b35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483403, "uuid": "9af5787d-497b-45d3-951c-1741a1084fed", "comment": "Malware payload (Mirai)", "value": "4c409ef485fc3ba3fa70e457172c94b07d0eb3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483403, "uuid": "5caa25be-1eec-4962-b234-05b51b155cb9", "comment": "Malware payload (Mirai)", "value": "667d97b567def6999f1cb9c2fb78c3be3d88b42e758e58ebd086ecdfe253b2950dc3b74136ac7cac943ad8d43b1f01c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483403, "uuid": "8bdf861d-60b8-4149-83f8-04a36588169e", "value": "T133430221F0B54EB8D2B238BF7931C54401A6E476E365240B13C68FEE74A958C9BE02F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483403, "uuid": "a31c1025-69b5-4930-9631-f1d6b91d69f6", "value": "1536:pcrJmEqTPgililLupgYDJVcRuBQTkZn+qVzw:2KZ6SgYDJVLacvVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764483403, "uuid": "559f9416-e6fa-4adc-b8b6-991c0219f7d2", "value": 58664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764483403, "uuid": "2e9ef43b-fd71-4fc2-92c4-65aa6b215fc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483403, "uuid": "6d8cfac8-011d-4065-baad-ddc62bc06643", "value": "irannet.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1ae92b-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468198, "uuid": "f716d8a8-ec5e-485d-a0e8-f363f7344270", "comment": "Malware payload", "value": "7c23944a957d9a57e36e4989e7c5c3dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468198, "uuid": "0a573933-3e24-4127-af3a-edb83d8969cc", "comment": "Malware payload", "value": "8773f1853d7a837ff6bc07f5839a668166f2311e0cf6e507086cc403471948b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468198, "uuid": "c89e907b-25a0-4d1b-b7b8-10a13725776d", "comment": "Malware payload", "value": "b71fc8ff20fae6ae183a2994504ebaa6623d020e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468198, "uuid": "5e38104c-62b8-49cd-9cf3-55289c3e64c3", "comment": "Malware payload", "value": "cf8f7d7b1eb9ee749daa5b78efcdb2ad4d40ef0e7948550259f8249fcffdd3d9e2520f680d07ecc83aa52935e4eb4ebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468198, "uuid": "bc1c0286-5a32-4595-8c4f-26068d0dede5", "value": "T1C975333B6123DA39A7DC5492B6DCC6AA1039E68F9A8CE5D520D0C481FB7712F510DBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468198, "uuid": "316363f6-ea35-49e2-b7f8-67c12e5e5a1e", "value": "49152:R9XKNdI+FKTxqd3bhg0iYIddNydYkaOzu/53rk3:RZWdI+clorC0iYENymketa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468198, "uuid": "cb339d7f-8ab7-459d-ba5e-324181d510be", "value": 1631496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468198, "uuid": "1e4e3e47-0c3b-4508-9969-878a197b298e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468198, "uuid": "933367ae-19c1-416d-a661-5e24c5ff7652", "value": "bizy.mipss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c32ab1-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1764490623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490623, "uuid": "5e018da0-59d0-4235-9424-7dcdf7b60f2c", "comment": "Malware payload (Gh0stRAT)", "value": "994f0fcf02c7e49dcc1d4af8505de003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490623, "uuid": "2a59ed93-95fc-407a-83f1-3226b1a4a95a", "comment": "Malware payload (Gh0stRAT)", "value": "884753940fa344b189bdaf678de283a9e37c843e56f51d1d8a9893e619952d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490623, "uuid": "5fc15ea5-5728-42f3-8b03-3f0a8af0ccce", "comment": "Malware payload (Gh0stRAT)", "value": "02a238ff1fff044b252d2d230888b03f5b5a23c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490623, "uuid": "2c44c7bb-03ea-4ceb-b1a4-c31cd57daf2e", "comment": "Malware payload (Gh0stRAT)", "value": "f7448002bec1b6ce24beaf807af88039607c9ef6a10f9a1114781bba70e358228f4ad12539ba1e7a992d9602f3b5629c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490623, "uuid": "51050559-17bc-4ce1-9123-320c5d0e9a52", "value": "T14E85CF27B2CB653FF07E4A3649B7E222443B7A6169128C679BF4086CCF260D51D3F646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490623, "uuid": "69b7c9d5-8f6b-4e9c-9dd9-f110d917dba9", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490623, "uuid": "9588b76c-19a3-4719-9dd5-820c865d8497", "value": "24576:DiAxXIrKbpw2rgoR6qfd3wP+qTSebDPV2Am0dF6Wi+uyv2Ko/dr8FjB7Fdw2Qcj:zxXXm66OSYx0d1J2t/dQFjZFdw2Qcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490623, "uuid": "3675494a-c077-4f2d-b9d6-e18781206c58", "value": 1833257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490623, "uuid": "a2f550e7-c77c-4411-9eae-1f10fa69bdb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490623, "uuid": "45c7c80c-7c57-4fa4-a4e3-ac5e02188cce", "value": "delta-workspace-installer-v1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2864b000-cdf3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764510468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510468, "uuid": "f4b0ac10-3e7e-45d8-adc2-4ddb49f55ec8", "comment": "Malware payload", "value": "08a7a5c11227042e678c10064f0d6584", "object_relation": "md5", "Tag": [ { "name": "92-246-140-209", "colour": "#4C2FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510468, "uuid": "45e1e1eb-5881-4ff2-953f-7fce283b22aa", "comment": "Malware payload", "value": "88734caea996666f162e34428df4553100e9b3e68d91fe29dee6d703dd730067", "object_relation": "sha256", "Tag": [ { "name": "92-246-140-209", "colour": "#4C2FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510468, "uuid": "c33f20be-aafd-4318-ac55-a084e5c18bc7", "comment": "Malware payload", "value": "22351d35458edba90b7e3f0b32d25f11294ec07d", "object_relation": "sha1", "Tag": [ { "name": "92-246-140-209", "colour": "#4C2FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510468, "uuid": "fc08dc20-4e2a-4ee1-aeeb-87694350bfab", "comment": "Malware payload", "value": "9b310a6d0abcc2f614a1902e94f1f011326c837c0fbd1d671b3d626f35026ea258ffdddc8e1d22ac1b5906a3c5a0e292", "object_relation": "sha3-384", "Tag": [ { "name": "92-246-140-209", "colour": "#4C2FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510468, "uuid": "c6a8adba-8ae3-4c0e-8d41-654de730a4ce", "value": "T1BEC70112A33D85F44878E325998BEAC03EADFA3F7138963449072E04ED47677CA8575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510468, "uuid": "a0b03230-10b0-4775-882c-613d5b5a427e", "value": "86beab110c1ac2eb8381ce4a4a235445", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510468, "uuid": "bd4f3e06-1ca3-4700-b918-5d86cfa7081e", "value": "98304:O62YQV0M6O7zp7l2MY5RZD1CZRQrhwND2Q7EsfkPyyhNy8hN1eWBBMmMQlAIAiNH:O9V0y7z5lw9E+ps0k6/f356UJe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764510468, "uuid": "1ffc47d9-888c-4110-84db-110d8f904ea0", "value": 57217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764510468, "uuid": "60c9d44e-7156-43d6-aef5-f6e9bf0ba87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510468, "uuid": "953b4db8-e401-4609-9317-e7d8eac4d059", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a47242-cdd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764499481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499481, "uuid": "236e60b7-9317-4739-81da-408aa0084e34", "comment": "Malware payload (Mirai)", "value": "7f94f76bb066b11ca9ba5ec468fbaf12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499481, "uuid": "815db33f-5ce2-484c-82dc-7a9bc604cfdf", "comment": "Malware payload (Mirai)", "value": "888cf4dcc7b2d768211e4249773cd12a140695f0ccd80f3e97b0a7f341380469", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499481, "uuid": "c95de870-2c5d-43c8-9dca-5e97a8ff1956", "comment": "Malware payload (Mirai)", "value": "7f9f38a8dd3ac520be7201825836110602810758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499481, "uuid": "bc6cf0f1-2a44-4638-898e-929898172814", "comment": "Malware payload (Mirai)", "value": "3b11f4a4e95ba1d68ab03b617f8f451b34a185e3c59aa3f7aadba37145f480aeafb69c8afff9fd8b24083f3a2c66a506", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499481, "uuid": "74d282e8-cdef-4aca-be1a-bdabd88b05a5", "value": "T150C32966FD818B11D5C116BAFE1D528E33231BBCE3DE72279D249B24278B55B0E3E406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499481, "uuid": "ef45c32c-8572-4f54-8f05-a9323033d905", "value": "3072:8dxRro417LNwvSxEjTraLh1xAZZoSsGMEhWGo0Q:037Jw6qjvaNHmZKGMEhWGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764499481, "uuid": "2363bfef-696c-40ab-b751-904fb431b680", "value": 128584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764499481, "uuid": "5810ed2d-7f47-4a7b-b10a-1b55a26b97ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499481, "uuid": "dcc6d4f8-4bce-44c3-b18c-1a3a83c6015b", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19fd36a-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468178, "uuid": "85fbd248-0b34-4830-803f-fc529402ad12", "comment": "Malware payload (Mirai)", "value": "d2256cd753c9847252b4a6a601b53992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468178, "uuid": "08e0a1d2-00bb-4d94-a2ee-b05dd513c7e9", "comment": "Malware payload (Mirai)", "value": "893cd4107f8be6a0f86d1dbf376352a029700c64b41a6cb69b47e4289d11bca1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468178, "uuid": "a0b43afe-ee9b-421f-a177-a75555afa539", "comment": "Malware payload (Mirai)", "value": "9c258684f72d3a050de2ef53512f349925e8363c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468178, "uuid": "4824e91a-cd82-4a22-bc53-e910a9631c9d", "comment": "Malware payload (Mirai)", "value": "9282ea2696123dd8d8a2125fd1676b152e24b8caff9528d8ed748ac748e2de306184dafde33f34ae1f5944c516518c83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468178, "uuid": "5e712f32-10cb-4ccd-85b6-4f9cfeb131b7", "value": "T1D5836CC4F743D4F6ED8706B19037E7335B33E1A95119FA43D3689A32EC91641EA0AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468178, "uuid": "599cec2e-a9cd-450f-a902-353219cc11c8", "value": "1536:ZF1etHglWAhmhTcMjaZW/TPWfLNjnZQCjBkkrS2RK:ZFYtHgEkm5cMjaZOgNZQEBNmOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468178, "uuid": "c67a3b3b-ae66-4a0b-90fb-d1aa7f4026fb", "value": 84104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468178, "uuid": "9b6c6c97-66e1-4506-875a-af79b26211be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468178, "uuid": "7d9084f9-dd93-43b7-8d62-6b5392284921", "value": "odin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf8a2b8-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540136, "uuid": "66f1e806-deab-49f5-8045-2f120174b1f0", "comment": "Malware payload (Mirai)", "value": "1cb39ce9695e7f8ad3a341389ad2d878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540136, "uuid": "2e4ef9a4-6ea4-449e-9304-d504c597fd93", "comment": "Malware payload (Mirai)", "value": "8ab8e328461034cee1972205617cb776602ed8518c1246a0630509977ad61554", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540136, "uuid": "155ab379-a2ae-4a37-8aa3-1f4f9c89f00f", "comment": "Malware payload (Mirai)", "value": "7cc4474b36a0af9323fd34e90cebc8e6a6fdf747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540136, "uuid": "9c3a2a4a-9123-4c80-81d8-48aa34e21304", "comment": "Malware payload (Mirai)", "value": "e39d4ffa473f732c864301710f20ea7abbfaa5391f480ccbee9d6ec172b7e5a25a77ca300f4c8a4cff421fcf3b5ba2c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540136, "uuid": "ca9334bb-d6db-4735-8a31-02086553eae5", "value": "T14E533941BC819623C6D112BBFA6E02CD3B2617E8E2DF73079D225F2037C696B0D67A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540136, "uuid": "2aa480f3-f8f6-4039-9acc-dfd170df176a", "value": "1536:OWMU9ZX7Z3Dt9hNLlYOjIU6ChdWw96sgvyWl:OWxha8IU6ChkEMyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540136, "uuid": "fe10374d-24e2-46a1-b71d-b484f09027de", "value": 65428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540136, "uuid": "55d5916b-6cbe-420f-bd22-e1be7e11b1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540136, "uuid": "20e67e06-2f69-43b6-bbd1-2af609af3c21", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf8a32b-cdf1-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1764509590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509590, "uuid": "2feda9fc-4418-4a23-9a1d-cec489c0396d", "comment": "Malware payload (BlankGrabber)", "value": "b3b485c7b3df8af17c0e8970962bb6c2", "object_relation": "md5", "Tag": [ { "name": "45-150-34-73", "colour": "#1FE8B7", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "panelbebra-gt-tc", "colour": "#92C095", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509590, "uuid": "4673fe3b-b8e7-4752-bd46-8fe78c24a175", "comment": "Malware payload (BlankGrabber)", "value": "8bc25acddf8217a6437c899e1f8becf0c3616497fa4069e1f0b0672a8e13b64e", "object_relation": "sha256", "Tag": [ { "name": "45-150-34-73", "colour": "#1FE8B7", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "panelbebra-gt-tc", "colour": "#92C095", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509590, "uuid": "93d79a98-8965-418f-8cce-e8491bbaf874", "comment": "Malware payload (BlankGrabber)", "value": "5759bacaf4e615151cfbe476f5333324625087dc", "object_relation": "sha1", "Tag": [ { "name": "45-150-34-73", "colour": "#1FE8B7", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "panelbebra-gt-tc", "colour": "#92C095", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509590, "uuid": "12cbb188-954b-4f99-9ab6-4723abc286ad", "comment": "Malware payload (BlankGrabber)", "value": "86183075b2136cf81d51a46fd8565a3020d779eff02596455dead68c180a2e77b72341720469224e1ad4fbe87a5c0277", "object_relation": "sha3-384", "Tag": [ { "name": "45-150-34-73", "colour": "#1FE8B7", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "panelbebra-gt-tc", "colour": "#92C095", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509590, "uuid": "3f81fec2-377a-40ca-9ce9-902ebc725049", "value": "T16B47337CF84A461435BC0201D1ACE334A1DAD49E6D5ED8D80BCAB1528CF7A99BB41DFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509590, "uuid": "3587231f-ef3e-43e6-b141-f977ce07f1e0", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509590, "uuid": "b9784184-6fb8-4e2c-b2ad-1aeaf685102e", "value": "393216:b5DSSOVLC7SX4v9Mt1YietkVrM08aY2/3T4BjidIp3apm0T4v2OHRCw6d97U:b5DS9SSIvxidNM9aY2T4EIp3aM0ZYI/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764509590, "uuid": "63ca7a50-4cda-4253-95af-227c2155dee1", "value": 24679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764509590, "uuid": "e2bfee06-e7bf-482c-905a-e5ac9f5bce2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509590, "uuid": "06385831-aef1-4db4-bd2c-d3e01f49a63c", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5d2fc4-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540169, "uuid": "19447cdd-dfe4-447a-b958-b0fd817ca545", "comment": "Malware payload (Mirai)", "value": "c255c4c99b0fe36b29519d6f2d323923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540169, "uuid": "fb187045-9d1b-4deb-bce5-ced5a2cfeafd", "comment": "Malware payload (Mirai)", "value": "8c82bfa8f3d6125d58b9347df7e8fababe424bbbeb2e12c190401be13b45a4de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540169, "uuid": "67f00c24-0687-4118-beea-49ee2703ce13", "comment": "Malware payload (Mirai)", "value": "dcd30536cea9fc4203fcc0f85a877b6a738d3986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540169, "uuid": "b2e3f532-5a13-40ae-a6af-1e3696802ec3", "comment": "Malware payload (Mirai)", "value": "3a97438ad0679843c515c589dae177facad664351bf5520e228e1b58d618e6e7ef4f402790ddc3bfb43df368cfedc519", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540169, "uuid": "c8978ce5-ca8e-461b-a545-7bcdba85e482", "value": "T19C732881B88B81F1E81388709567F33F8731E9544235AB19FF56DF7EEA23A41562239C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540169, "uuid": "37d09438-e40b-47c4-84ee-4a28b2b14358", "value": "1536:2uFmjqh68C9rNzHx7hSxikQS5hseLrtjWZ9yaPGALk0hV4StV3:2uFkNRAi5S5hsAEZcaTLlhPtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540169, "uuid": "f9839dd2-d899-4145-a3c1-b074e8523546", "value": 76096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540169, "uuid": "e38469b7-262b-4519-8e1b-eda6057ee7d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540169, "uuid": "61b07289-e8f6-43a5-8236-cecbb024feaa", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619289e0-cd8c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764466326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764466326, "uuid": "795b53fc-0149-4e15-8329-850882d7bf9d", "comment": "Malware payload", "value": "7f63e33605db456d23ef7fa478f163b9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764466326, "uuid": "0da0b01e-66b4-40ae-af04-029864843b07", "comment": "Malware payload", "value": "8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764466326, "uuid": "f987a8f9-842b-4db4-8d3e-e9f3204397c2", "comment": "Malware payload", "value": "59fcece018e9ec61780e9c39f5c4160e6c98e679", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764466326, "uuid": "3285254c-e958-46fa-a07c-9c26b85ef1ed", "comment": "Malware payload", "value": "f9b31d3d60df934476768fc0ce61ec627f57147bb34689c23ff76d0dc4fe9b57f2535e434c6f3d29a9aeb00a4996186c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764466326, "uuid": "2e684dc1-b5ba-4cbe-85e1-bb380bd205bc", "value": "T15536E047E2A320ECC56BC174476B6772F931B8591134BE7FA594CB302F22E506B2EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764466326, "uuid": "2973176e-8d4e-42a3-ad66-1cec9286c713", "value": "4001d25cc44a5146e1045bfe56dee420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764466326, "uuid": "c8129aed-b149-4549-bf53-36b605b4a987", "value": "98304:J2YgpA79tqLqWox4dmbDaapjar2hKYADYAZSsz5wPISRMS5kB9AH:t4dmbjpjar2hVb65NC2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764466326, "uuid": "b814d409-6a50-4f83-a940-60c2450e9050", "value": 5020672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764466326, "uuid": "a8b68622-95a5-41d0-974a-27f8c46f18b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764466326, "uuid": "04df67e7-803c-4328-b81f-615ab1fed7b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbebbdb-cddc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764500733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764500733, "uuid": "ac900e53-28c6-4372-ba93-b299d490dbd3", "comment": "Malware payload (Mirai)", "value": "7da7eb94330de82cca0e997a06c4e361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764500733, "uuid": "3fd83a0c-091c-40f2-97d0-4ec890f4bb1e", "comment": "Malware payload (Mirai)", "value": "8d2536d5d033671ac811e63d996c8bed440eca6ca7678a3f31453294838be602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764500733, "uuid": "93bc79ff-3afc-4589-8d28-6f88206e4ac9", "comment": "Malware payload (Mirai)", "value": "6d99d9bdb206e2701d9860a72d9328af104ee134", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764500733, "uuid": "c8c0f29d-ec89-41a2-8a80-b9e435945413", "comment": "Malware payload (Mirai)", "value": "085546dd56e75ea8b095fbbf5590508fc81c49936b2ba14c9899ac9903e3aa56e5c72aeab3893074e43a566e30d79206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764500733, "uuid": "9796b6b4-cb06-4398-88a4-983ffbb4e2cc", "value": "T1BD534B9AA804DD7DFC4FF6BFC4164E05F565731465820F27A3AAFDA36C320A48D1A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764500733, "uuid": "b082e8a0-2c87-4d49-9088-e3faded5b2fa", "value": "1536:N/yfU7Zi/2pnebLdwA7NGLFuGk/kgkDWjT6TPwiSpG5uwxdHb83ByP6:NuLdwEGk/kgkDyWTINpwxNUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764500733, "uuid": "3c44cd4a-870a-40bc-997f-316acde7ed0d", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764500733, "uuid": "34f08ee6-8df9-4819-bc15-a23ea9f93d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764500733, "uuid": "7a5c2607-6565-4afd-ab1d-7554bfc2b94e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0478f4-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538794, "uuid": "820a35d7-fcad-40c2-8cf8-89c02e93b228", "comment": "Malware payload (Mirai)", "value": "b354059d5a01e9af1e5a70c88460bd20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538794, "uuid": "69f42e05-e45c-4096-a1ad-dc56cf67b5af", "comment": "Malware payload (Mirai)", "value": "8d3b539a1ba7a4aa9346a07fbbd1b3c29d29897c2efc2bc6953fbca6100089c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538794, "uuid": "f8a54286-ea63-4cae-a463-ef36edf1af84", "comment": "Malware payload (Mirai)", "value": "83b5a00cd5d2275d157b07fd4bfce0bf2611c9c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538794, "uuid": "76d50fa6-fedb-4d78-b059-839ca53f8025", "comment": "Malware payload (Mirai)", "value": "4abd90dafc74453acdc9f47edb78ee0ecc3ad266fbb9282a65fe900ae540e7d5b663cc9362dc7ec6cd32b1653bdf1439", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538794, "uuid": "c816f996-424e-4f18-882b-8deb7d35060e", "value": "T18A31B7E6D1735D713609CE1EFA6E13D984832EA7789B74AC9FC29CC5100D1ECB294A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538794, "uuid": "8ed2a9ca-8ed5-40eb-9a68-6c6d971f0538", "value": "48:6WdPyJPeyPerpPPqxPWoPajPCCPE0PCnP4tlPUwPugx9M:VRJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538794, "uuid": "b9d6f5f5-ad53-4588-ac3a-00dfd90a2593", "value": 1817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538794, "uuid": "9c9415a3-3ebf-4d01-802e-6c6054bc156f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538794, "uuid": "24f33bb1-ec94-4d42-acc5-272f8a322e39", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b4a53b-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494247, "uuid": "865689b8-eec4-40fb-8632-68263d95bfd3", "comment": "Malware payload (Mirai)", "value": "68948bb0de3608c743b9f77460a4b737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494247, "uuid": "9be2eb33-9e3f-4bc6-b01b-1d9702db94c9", "comment": "Malware payload (Mirai)", "value": "8dde441bc4513427a68fadd4460be707fa94121d3d7404fb7c8aa00d680c6272", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494247, "uuid": "33c040c7-5ed7-4d35-88fd-ada6f22ba00d", "comment": "Malware payload (Mirai)", "value": "46d287409d9ced4663d574a5cf01d4dcb6114f58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494247, "uuid": "02fdc2a3-977b-4463-81f5-0d1298d98716", "comment": "Malware payload (Mirai)", "value": "6174feb0df16030eeb300d9931f88b14f276b677f6e01521c3bd12a9e22e9f56e593d61edc15b6d928e43f13ab130b73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494247, "uuid": "2ab71426-544e-446c-9f4b-59f01d084a50", "value": "T1BB14B81E6E228F7EF6A9C73547B74E24975823D623E1D641E1ACD2111E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494247, "uuid": "76411163-29ba-46c4-be0b-53cc9cde739c", "value": "3072:QDy7dCcHfWaKYCYv5RuiMK3+cQOXfj56hh1PBDV:QDy7dCaWalr3bt+eX7EBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494247, "uuid": "b572c30d-f0b4-445c-b9dc-d3536e4ef373", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494247, "uuid": "27331c1d-17b7-4ca6-9d2e-12e437b4a7bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494247, "uuid": "aaef23d6-cf8d-4276-8c36-901d3657ee8c", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6359fa31-cdaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764481361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481361, "uuid": "a7eb3ac9-d1ae-44da-94d6-b6d52a16940c", "comment": "Malware payload (Mirai)", "value": "98e4862e775fd8d911ceccb6ca04f75f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481361, "uuid": "9c719173-f022-4454-b3bc-8dfefb941993", "comment": "Malware payload (Mirai)", "value": "8e2b541a41f5d6014af5be76c835bea676c78291ca5eca4f37b45b873d003722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481361, "uuid": "f02f3d1f-976a-46ef-ab7f-2658523c879d", "comment": "Malware payload (Mirai)", "value": "a6057f1fb309399ed3e0f77f7910002e12818bac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481361, "uuid": "d5e066f6-67f0-49bd-b492-bfd065f2fd6c", "comment": "Malware payload (Mirai)", "value": "89fe31405a4748563c29bf4f0e8f531f562ad313b1ae68f049579e20e024117c95ead772270a8407bbee0267729c3577", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481361, "uuid": "36f9b745-8fbb-43ed-900c-d3ba2d63e76c", "value": "T10D63E786B991CA25C6D452BEFA2E118D33131778E3DF7253DD106F157B8A82B0E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481361, "uuid": "46573a60-e88b-4d22-b320-970df190ff8b", "value": "1536:QhnlJdkqi8dPfk67q2dK1Kk26/Jeh3kMti2RoH7n/gtug7R:4uqRfk6+2w1z26wRoH7n/gtug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764481361, "uuid": "308c4a68-2ac6-443d-a823-06624d6f093b", "value": 71708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764481361, "uuid": "ddbf4420-298b-487d-9f0f-00383c40ceca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481361, "uuid": "6fd69fa6-ecbf-46cf-8573-abcbb8e25115", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f691f7-cdeb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764507023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507023, "uuid": "5f5183f6-05cb-48be-a081-c711866dc640", "comment": "Malware payload", "value": "5e9f0902f37821b6a90f61ad321f2367", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507023, "uuid": "f8dc3fb5-cba5-48ef-b93e-eef190b44fa1", "comment": "Malware payload", "value": "8e5d509500f73d2099bc47439076938d233ac273b4800d9f63d970002264e544", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507023, "uuid": "4502a8f2-ab68-419f-9b59-51ab0c52cf60", "comment": "Malware payload", "value": "2e569000a55f943e782b4873180b088898ecc73f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507023, "uuid": "a2f68428-323c-42f5-9422-5d3bbef61c41", "comment": "Malware payload", "value": "cd64d981e61059be997bd8a28f28bf0a35a8607ed52432a743242118d54b0115bd0f886e7ac7ee39db9badf0d04e735a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507023, "uuid": "5f083e4e-a94e-4af3-8236-3eebcba411e9", "value": "T16D7352880DDB94E8D62774588EDF8C51FBE48503562CCDD5FA8DA5E02F02538A3F68E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507023, "uuid": "5da61ab3-39d7-4902-9f49-21c058557924", "value": "768:x/BgJf+Li7PYp5hG8yq7PcfkVUdbgHDn8eBTphfcHPhbGj3fgwjFEbiwCiAf/JNO:z7mwphytS3fKUZW94L1QG4QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764507023, "uuid": "7ccbbfd6-fb21-4023-9942-12eeb82f9137", "value": 76553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764507023, "uuid": "8436e6e9-2b78-4ad4-a16a-67c0b18f8d06", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507023, "uuid": "cbd292a3-c95f-420d-89b0-10a23cc04c2f", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaae43bc-cdaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764481481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481481, "uuid": "6252f265-426b-483c-b400-e7fba6d7ccba", "comment": "Malware payload (Mirai)", "value": "15d372458391985f5968489633d8b1fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481481, "uuid": "ffd345a3-b4bb-4ce9-8330-7a941d9edfbf", "comment": "Malware payload (Mirai)", "value": "8f16989a971cb30ba1aaa38899c9995c4ee028cca3c94bde669a7fb0bf33616c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481481, "uuid": "bf693c49-ebae-4d60-81cb-9ab0d763031b", "comment": "Malware payload (Mirai)", "value": "035632e77ef8492b68a6d022e0b5564672ecf1f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481481, "uuid": "8e2f9cb3-d35d-4f43-aed2-c2071d99e0fd", "comment": "Malware payload (Mirai)", "value": "d37c3cbe4b88b6c55a02f560c6717f93f19b0d94167a0a9f94b5f6d48eabd8f9cdd9e43c2226ed3111a90fe68ea4543b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481481, "uuid": "970aa869-4d04-48a0-8f68-7061cbc25503", "value": "T1B90429C7F900DDBAF80AE73748130909B130BBA204925B776257357FED3A195196BF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481481, "uuid": "db8cf1fb-c47f-4a6d-813f-d354904cfdd3", "value": "3072:NG5A9xwDFvLx0cjyJt5CcD92DhL6oir9gfdVCjbiKLgh8GMeIOzwwA:e9pyJfCcDMDvKgf6LcSOzwwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764481481, "uuid": "7be8f9a2-1f78-4e78-9d1c-3a8ea75e0f00", "value": 180932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764481481, "uuid": "6b2b17c5-9232-4ee8-a3b4-6f0beae25c26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481481, "uuid": "d93fd202-7c9f-474b-a9f6-f14514ccf649", "value": "irannet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef191338-cd8d-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764466993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764466993, "uuid": "05ab02a3-2213-4006-843d-f1fbdb85dcd1", "comment": "Malware payload (njrat)", "value": "1e97881fc5987c1f8797963a2a46d084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764466993, "uuid": "b31fefde-1933-45cf-99f8-102519137ba7", "comment": "Malware payload (njrat)", "value": "9167a6de9f7185fee155507fe0309a9ea4938c0583a2e04c02de0329b57293ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764466993, "uuid": "65a5b677-cc41-4b32-b607-68aaeefc1a1d", "comment": "Malware payload (njrat)", "value": "4b5f1734dae3f0551b0754da75d93fe253c3bec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764466993, "uuid": "78f1e993-acb2-4719-bbca-b66899c8e788", "comment": "Malware payload (njrat)", "value": "e4f908e235deadee5719c353fe7b50c4a22acb5871f9e3b44ea467da6099a8cf3ceaaf9d0a290a4b16da6b18b2f3fd51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764466993, "uuid": "98303055-9c89-4514-942c-0b5bfa945183", "value": "T16E55149D766072DFC85BD472DEA81C64FB6074BB931B9203942716EDAA0C997CF180F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764466993, "uuid": "0589267d-d4ca-4cde-b1f7-37935fd767ef", "value": "12288:gSOIaBCjP4SuYkMkylZzZoKExhe4reGvm9IMTkI6ZOO6ZYeUC4C+25ifBAXllL2R:OHCjPLN5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764466993, "uuid": "d315f091-00e8-4a0a-b404-af5fc6a80c1a", "value": 1280512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764466993, "uuid": "caf9114a-7970-4397-8661-4507322e5441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764466993, "uuid": "c8528155-289d-40f2-9b0a-80700bfb2296", "value": "FinalMom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1112bd91-cdb1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764482082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482082, "uuid": "08c571a9-77da-4936-ae4e-9ff41412b254", "comment": "Malware payload", "value": "fd5827eccedeeb6291d4cbb8337188bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482082, "uuid": "a2494dfb-e6bf-4c89-9994-26981f574926", "comment": "Malware payload", "value": "918db1ba343ba06651a4cae5b9d6930f70d06820551bbfb79f74c1e0e68b63aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482082, "uuid": "e2f5bfd5-2dbe-4879-92b5-271117c1468d", "comment": "Malware payload", "value": "9831647a67baec047fa475dfb0db8da45f3fd990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482082, "uuid": "fb47c7fa-b527-4a9c-8e8e-74d6c3c8fe1b", "comment": "Malware payload", "value": "5fc99ef9c897de3cc600b95e87242da561ba715ae2f5cdbe2fa0d6a0ee9880a7d323e66c1f79c99cf26db127204acf01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482082, "uuid": "4746f6b7-5202-4ac5-aff7-21961cd62fa7", "value": "T18D83B449BB650FF7EC5FCD3B45BA5B04289C950A22A43B357934E818F64B24F19E3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482082, "uuid": "6f839e50-b38b-4849-b2de-760879fc96db", "value": "1536:CoRdeABu6GMoL+9Ocdur7/vCiJdMC122sjug7R:CoDru6poy9erzajug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764482082, "uuid": "6a4e7dd6-9361-4a57-a25f-293f08f9d343", "value": 80812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764482082, "uuid": "40eaa067-1d9d-42af-a8f7-fb85a920b365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482082, "uuid": "a2225e58-dfd7-4544-9157-e98438629258", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28de348f-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496725, "uuid": "12c40556-1f2f-49de-805f-d3ab649fbb92", "comment": "Malware payload (Mirai)", "value": "29eaabc2499f3d3e93d87de5372ee896", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496725, "uuid": "995c7d56-3770-4a0d-ad44-4389594d58d0", "comment": "Malware payload (Mirai)", "value": "91916a301f6a4a76990dfdebb2eebb580bdbb5cc2df74b05965b4e95a8965d0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496725, "uuid": "96f31eb7-b589-4de0-9d0a-ed37ba9fe8f2", "comment": "Malware payload (Mirai)", "value": "26d496be5ba421c17a5cf5a741e9eff452f72fce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496725, "uuid": "0c08f4a9-e5ad-43ff-a0e5-7477ac367ef4", "comment": "Malware payload (Mirai)", "value": "3a8d8a57ce64d40ab224b17c9ea8125db65c4b4254d2384550b0a8e1728d6927bc2a638e73bd8a2ee1e3df41199dbf86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496725, "uuid": "f8e40c43-b33e-40cb-b6a6-0d424e145927", "value": "T11E43F155335399B2C7C4983BCA9490132F9E3BF6D948350B55E02BFCB16BA84C9F1AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496725, "uuid": "bc95eaa3-070d-4942-844d-67f9409dcb6b", "value": "1536:ZoZVdjMI2ANMTdsJb9e8Q4Y87ejMUe+Cbj3Lk:ZoZbb5MTdKxe8Q47ej+fLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496725, "uuid": "d91fac9d-2644-489f-98aa-9cb913d39c99", "value": 59012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496725, "uuid": "bd35c975-c282-4f13-a8c2-077d0969ab23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496725, "uuid": "d7a66c62-d92d-4e87-9ca7-5ff00924bcd9", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bb9d3b-ce40-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764543533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543533, "uuid": "26d4d1c3-964a-4534-a255-4e8f74f2d468", "comment": "Malware payload (AsyncRAT)", "value": "70b96ef45169600548059df8231041d7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543533, "uuid": "32280b6e-4ffe-4ede-b547-051edb422416", "comment": "Malware payload (AsyncRAT)", "value": "92b8982a53066a028d9b6d0279d93b8ec150e405fa07a102f8047c67c7fc4ea7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543533, "uuid": "e0529b99-7bd1-4369-94a3-c55067b31b0c", "comment": "Malware payload (AsyncRAT)", "value": "8cee6fea2d36c726bc409928dc0267ce10ba52e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543533, "uuid": "3f4b460c-dff5-4d9f-89cc-25026e644588", "comment": "Malware payload (AsyncRAT)", "value": "deb432eff256cda62bb7a388ac3d1f7e536be55740f92496026bd47cd2f2d8feda2af5e16f9d3cbd933788c0bc662597", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543533, "uuid": "76e244de-67d4-4ced-a6be-6edba4eb38d1", "value": "T112637C587BE50525E0FFBFB41DF67212CA7EF6134803E60F64D9028A562798CCD426EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543533, "uuid": "978bdf5d-be3f-4240-8040-74aa89ff9033", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543533, "uuid": "6e2639a1-f692-4842-8c40-223c7774244c", "value": "1536:u2HG8tY6Ua0x8hWNIkteP/bHbTNTKS63OlWcQ3dGb:u80xDNJtobH1KTOlWcQNGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543533, "uuid": "a8efcb3b-0c02-4a9e-b154-78df68a8079a", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543533, "uuid": "c6e9892a-eccf-41bf-8fe3-88fbdb8d57e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543533, "uuid": "2dd11b30-6b11-4fb8-ba3e-dfc5e88b7cbe", "value": "Windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4c368d-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468193, "uuid": "6390619f-e8fb-4aa6-a503-9b83bfcb24f4", "comment": "Malware payload", "value": "00f3e4101aa82c49b5b616c26fb323c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468193, "uuid": "660c8b3f-8745-4c37-a2a5-e6cbe8894844", "comment": "Malware payload", "value": "96016d9533b9c4ac61d86048f73ad47e815d689c7955703dcea5abcb4553ccf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468193, "uuid": "9180312b-9ece-47ea-be98-cae0a3a25c0e", "comment": "Malware payload", "value": "66103e2cadf80a8f7522597e8ab48447a488b8d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468193, "uuid": "e6e1d008-95c5-4777-a5f7-c2b8486225d2", "comment": "Malware payload", "value": "cb2d1133f7aeca32d1c4879ce6b59e204176a07763f60771cb1b69639dbc0c7c7955b51457381261e395ff12ffd827ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468193, "uuid": "302fc73a-69f7-4813-962b-d141d34a94ea", "value": "T12A066D0DFD609F62C6A4037649F9168823709D022FC7571BA338F77CFDBA6949C86686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468193, "uuid": "ec6527d3-0b77-4d49-8d20-6bd5d1915b9f", "value": "24576:Y/H8Uyb7bspzFOuCeY2tBE9v3EljntvRohexPPRa1kYqU2hpdIjvxoylOqaGyk5i:Y6beY2dRnPRTXdIjvxl4M5Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468193, "uuid": "c025f1e9-c180-4adc-aa1e-e8ea82243e1a", "value": 3932344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468193, "uuid": "8e356aa2-0e7d-4cd2-b86f-833b0941286a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468193, "uuid": "74639c7c-7017-4182-89ef-44478ba88e10", "value": "bizy.riscv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f4b2f0-cde5-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764504552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504552, "uuid": "bf3d6641-ba60-421d-94a2-cc73312622eb", "comment": "Malware payload (MaskGramStealer)", "value": "f6d5d385abc4627de794777a15778a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "SvitStealer", "colour": "#0E6C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504552, "uuid": "36781c3a-0875-49f9-8339-f55eb2b5ef78", "comment": "Malware payload (MaskGramStealer)", "value": "96b660b9136ea1903996d44fe6b758f07726aa4f68f519a03836667b8f6395a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "SvitStealer", "colour": "#0E6C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504552, "uuid": "f9b3998b-52a0-463d-a267-a5488d792185", "comment": "Malware payload (MaskGramStealer)", "value": "0dfc4949907058e0b6c0ec55c5fa854921ca5e06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "SvitStealer", "colour": "#0E6C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764504552, "uuid": "cb3d4537-bea9-4153-90b5-8c10dcbed655", "comment": "Malware payload (MaskGramStealer)", "value": "f21268888600fc8d9b05804564ab2109a3e490011b87d1f2c629263e32ceb87ea3d12597705b073ebf5c59709cd77481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "SvitStealer", "colour": "#0E6C2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504552, "uuid": "c36968fc-7e65-4def-8131-941d6f405af3", "value": "T13D76239293C9A3E8C2E30B7422C2548E74D27E7A98BF5A4D2DC97C025776F4E484B771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504552, "uuid": "42363326-6a62-43fd-8037-57cb1bfd9e92", "value": "ea281082cd6342019a4640d5d7089aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504552, "uuid": "f09ec0c3-365a-455d-971a-c927c3a250c6", "value": "196608:8lZ6U60E3GJcU12AtrYLNhsI7Z9pg6o9+fwOdO:pU60akcU1jrYL4IN9pg6wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764504552, "uuid": "994eaa1c-a7fb-4af2-929b-022883a83723", "value": 7560704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764504552, "uuid": "1059c79f-d4ba-4f1c-ac19-2794ae3786f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764504552, "uuid": "344519b4-602d-4f77-b21e-01db70d03a3a", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd1f972-cdf2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764510340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510340, "uuid": "604e2d72-748a-4970-ad66-4a6e074b4a6e", "comment": "Malware payload", "value": "65e98ab13859dbfbf263c0882166f710", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lunexmods-cc", "colour": "#90150E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510340, "uuid": "73fcfd20-45a0-458e-8c54-6e3a5ba56bc2", "comment": "Malware payload", "value": "9757f4f6959a76267bada1982ad1b71cb48029d6b48971b65086e6d2bc53bcdb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lunexmods-cc", "colour": "#90150E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510340, "uuid": "23f38a68-2942-41ee-a628-4272c3390770", "comment": "Malware payload", "value": "8624eb09aec9c6ff31a5ec25e965306f0a5a412f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lunexmods-cc", "colour": "#90150E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510340, "uuid": "d4d49dbd-68af-4570-be10-d3f2c033eea4", "comment": "Malware payload", "value": "efadc74eef011c08e41b40ff0aaed0dc374d5aede0051091d871f7a005f12b7ab3336d19d3e4a037d75d77f7b2439c26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lunexmods-cc", "colour": "#90150E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510340, "uuid": "556704c0-9c49-4504-bf86-c9dc253ee282", "value": "T106C59C14A3D805B4D577DB74CA919233D670BD869331958B07A8FA192FB3EA04B3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510340, "uuid": "02d7eb07-1831-49ec-84c1-02a628190626", "value": "01bf5a6e443d752037dc761f038c6287", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510340, "uuid": "eedc1601-d0fa-46c0-8dfe-9b48a9609f55", "value": "49152:iTmZAwERBembZ+Bpp6ZhKFr/jZV1CTpPz4KFlHtv40:aRBNbFZMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764510340, "uuid": "4967bbc5-982a-4b67-af5f-0aefddc274f1", "value": 2742784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764510340, "uuid": "4781689f-1ce1-4778-a2fd-97599086c4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510340, "uuid": "fba81084-e15c-493c-a97f-037646e758a1", "value": "glib-2.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f2fecd-ce28-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764533526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764533526, "uuid": "48bf744b-1e8a-4e6e-a1d7-b11f624b652b", "comment": "Malware payload (Mirai)", "value": "2072ffde6afbf487d4b70557b75db3b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764533526, "uuid": "8a9f4f2e-da3d-4c2b-bce3-252f371da98e", "comment": "Malware payload (Mirai)", "value": "9785c2453588c8095608556524aed2e534f5d6badb4fcd22e89b93e04b588551", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764533526, "uuid": "e5a156d3-09a9-4912-a05e-ab6d84ef7db7", "comment": "Malware payload (Mirai)", "value": "353f6a52958db15ee7b40d07143884f867de1e0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764533526, "uuid": "63b5c650-b750-48b2-b797-d670789917e3", "comment": "Malware payload (Mirai)", "value": "90815421abdd37868234f4b65063a979388f023108659076452e417c53db552a95e6ca6222ccd2f0ef3f1c1b057b74f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764533526, "uuid": "fde0220c-c09f-4937-9053-6735a668017b", "value": "T1DB6402DBEE51BCBEFD9A8BB025670B1A77F4D9C5D2C3A580B26885443CBD241E7502C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764533526, "uuid": "2e50b720-47ab-4d98-97e8-e8c18304472e", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coza5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZncnPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764533526, "uuid": "764eb4e4-1efe-4fdc-967e-0e194cc2807f", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764533526, "uuid": "cc109cc5-1036-4560-8709-8f177cdf2c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764533526, "uuid": "27bad62c-b0a8-4ea9-bac8-f5c21bc23087", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091b4099-cdee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764508268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764508268, "uuid": "d2bf0237-7745-4d31-baac-05a4aff77951", "comment": "Malware payload", "value": "4c05d4bae3c0695d4701108df6e1cf2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spy.Agent", "colour": "#098351", "exportable": true, "hide_tag": false }, { "name": "trojan.ibwsh", "colour": "#348A5C", "exportable": true, "hide_tag": false }, { "name": "Win32.Trojan.Agent", "colour": "#837C67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764508268, "uuid": "07205bd8-d7db-406c-a629-e199e64809c7", "comment": "Malware payload", "value": "97d2d0dacafb9f92ac67492eb4a740e05bd5f8b13325a942fa127182bb6d9593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spy.Agent", "colour": "#098351", "exportable": true, "hide_tag": false }, { "name": "trojan.ibwsh", "colour": "#348A5C", "exportable": true, "hide_tag": false }, { "name": "Win32.Trojan.Agent", "colour": "#837C67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764508268, "uuid": "7da3b092-b196-4d9e-a384-c6e17e16eb41", "comment": "Malware payload", "value": "83f3c048063a50c1dc653e344e171cf7d2cdf944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spy.Agent", "colour": "#098351", "exportable": true, "hide_tag": false }, { "name": "trojan.ibwsh", "colour": "#348A5C", "exportable": true, "hide_tag": false }, { "name": "Win32.Trojan.Agent", "colour": "#837C67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764508268, "uuid": "09fccf6f-d39b-4a42-93ec-c2d32d5b9d81", "comment": "Malware payload", "value": "a568e36d6ea5eac61f3e5b863257515dec1a3eb04e88515bd077cddaab4638ca475a19e677687d58dabeadc4ed25314d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spy.Agent", "colour": "#098351", "exportable": true, "hide_tag": false }, { "name": "trojan.ibwsh", "colour": "#348A5C", "exportable": true, "hide_tag": false }, { "name": "Win32.Trojan.Agent", "colour": "#837C67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764508268, "uuid": "545ac994-dde9-4167-9971-8f57d0b36f42", "value": "T188A65B00F99748F5E9072A3199AB236F27345D068F25CBCBF6457A2EFC7B2D21936205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764508268, "uuid": "d7d90123-d932-4899-8c8a-9172ef76be45", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764508268, "uuid": "333f70b8-0cc0-41f4-83f3-7c035f656cd9", "value": "98304:ZzkE/qHZe0A3hA3smOdUzbM0pBtTNus9N2ALWyWuLaz:XKZeAieHM0hTvuoJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764508268, "uuid": "baa651ff-c783-4241-94e0-eb90fcb34d98", "value": 9492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764508268, "uuid": "ff76c88b-1b8a-4612-ab45-e4e2cb811cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764508268, "uuid": "d54033d6-9caa-4cb4-a960-1887d01c298d", "value": "bgm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424def3a-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764530698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530698, "uuid": "6acbae57-3c9b-4f60-a571-28e46b62da05", "comment": "Malware payload (Mirai)", "value": "b890dfbb08cee764a1c583831a75b763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530698, "uuid": "cdf67afe-f802-4401-8562-e8ba69d9d717", "comment": "Malware payload (Mirai)", "value": "98a15b2e48f4a2050b77b0932584ed023863a2326270658f3f42bfb626f47b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530698, "uuid": "5da6ad03-a060-4093-a6dd-03f0b9a86766", "comment": "Malware payload (Mirai)", "value": "31d8a889d6ad50774f0d44ac922a062fe0f2a6ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530698, "uuid": "781b893c-ba37-48cf-9d66-e8217fe67ff2", "comment": "Malware payload (Mirai)", "value": "5b837620adde8ab1ab8b5542ba4fef305d817ff318aced1cc72550dbd04dd71bc4c54edc06022e19ab38d8569b5f138e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530698, "uuid": "32796223-802e-475e-996b-22e28175d9b4", "value": "T1A834B6066B515EFBD8AFDD3305F98B0525CCB44762683B3B36B4D62CF91A90B06D38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530698, "uuid": "bf475ca7-f64e-4c6f-a55a-4f6978e34b4f", "value": "3072:gqiAT06jTFkTGpqmV/Z9QC4TfjhX5Z9QFDcEUA86vQ:g2A6jB8GpqU998fh5TQFoEUnoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530698, "uuid": "e2434efb-5c73-4d56-a5aa-eec173ec1737", "value": 230416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530698, "uuid": "5c55ae0a-e1f2-4c8e-bbf2-72697a91d843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530698, "uuid": "b400e4de-d87b-404f-91cb-13049a56830e", "value": "lava.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114b0fa2-cda2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475640, "uuid": "efccb844-8ba2-4978-9646-85c80d6723c1", "comment": "Malware payload (Mirai)", "value": "2bac2dbafafb505ac17d3bf7e73b7e38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475640, "uuid": "484d3c7e-61e3-42f1-9913-fa558cf763c2", "comment": "Malware payload (Mirai)", "value": "98fc359d733b2736dce9bacd8a8d9ed97961dd51680725f7673b5500d6d300e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475640, "uuid": "c4dabac9-4747-4fff-b159-8ab1d32eab6d", "comment": "Malware payload (Mirai)", "value": "d76c6cf0af78f4dd8ebd25b9386545d85b6a1de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475640, "uuid": "b7af2e33-7f02-4850-94f5-f6d018bb182d", "comment": "Malware payload (Mirai)", "value": "b2a9d894e464eca5d5d8f08856fd719e53e1de8a67231b61e2bdb2a3227a23957f53a239e4311fce2a0b21c99067b388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475640, "uuid": "6be7b442-2080-4144-af9d-222b69748f06", "value": "T18B042991BC505F62C5E623BBFB5E428D371513A8D2EF72078D226F243BC695B0E7A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475640, "uuid": "1710fc1d-edae-451f-8745-54f18b2e70cf", "value": "3072:4CeTsHj+FN2TFUgrLeJP+iQNsySwrRI1wnEW4oq+UYxiCs32f:4CeLwr9EW4oqhYxNU2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475640, "uuid": "35e3c984-d4b4-4a36-87e7-d37f4be4c0ad", "value": 174476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475640, "uuid": "c6cf5437-2aea-4d15-b01c-fcca74a1c8bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475640, "uuid": "3ac08a0d-dab1-4fa9-b633-b089af4feafa", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63984919-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468047, "uuid": "cb9ce9d2-1032-4582-89ca-967c37859b19", "comment": "Malware payload (Mirai)", "value": "7dfbfdb5be7575f415aad7176b15632b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468047, "uuid": "42708044-cf69-4baa-a49e-ec1549646d63", "comment": "Malware payload (Mirai)", "value": "99aae495cbefa91ff718d1cfef7bbcf3af5e9ac4df46da612f66d11a8562089e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468047, "uuid": "7e2b52d3-ab59-4b8f-92cd-a280bd98ae1d", "comment": "Malware payload (Mirai)", "value": "38689a2284ae319e456b526fcdfa9ee6ef49e94f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468047, "uuid": "f398905e-46cb-48b8-a424-62d769c7be21", "comment": "Malware payload (Mirai)", "value": "a7095dddcd1034eff43a1aa3bc3fa017174715ce0451e3c5537bc64da8b38da7220bc65076259433b141ed56aa7a46f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468047, "uuid": "05a28fab-6555-4605-82a9-1df583ccd20d", "value": "T1E74141FE517456A2C0C8EE21FEA0D1D69C857BCEF2E42FB1964AAD31C8A9DB030117D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468047, "uuid": "c5e95f13-bccc-4492-ae67-952bccac9745", "value": "48:xbVbX/Bv/Bd3KuB5LBxvBB9pBz/BqiqeBZJRBpy2BtvnBZ7/BJHBtQ:plXYd/K4u0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468047, "uuid": "06a09410-e3c7-409d-bf9e-af61d9fe54bb", "value": 1963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468047, "uuid": "e043533a-866a-4cf6-854e-3606093902b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468047, "uuid": "5c68c6d2-0068-47ae-98b7-b406f21d7152", "value": "ssh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a3f77c-cdd7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764498525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498525, "uuid": "5809a17f-324e-4088-9f0f-88ab81d850e7", "comment": "Malware payload (Mirai)", "value": "492e9a52ee0d6ba1444e0ea884920cb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498525, "uuid": "6dea311d-1e24-41c0-8434-b71e08d28aa0", "comment": "Malware payload (Mirai)", "value": "9d4fbe7816f7073ae5c7a254c992ba8db5a4a511272999364c072dcaef1b92cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498525, "uuid": "e4ac8365-51c6-4cbc-9f58-af4f3294e668", "comment": "Malware payload (Mirai)", "value": "9a272775518d843406b6c6410607d9d0151dcab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498525, "uuid": "acb207f7-f7c3-45ba-9c4b-a3f95c12dbf9", "comment": "Malware payload (Mirai)", "value": "d765edd966fa9ecf7c63f463a7419b54c8e775baa9fd7a27102fba306f9e9001babe81c51ef70f28064cfbc8b3f6560b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498525, "uuid": "91db3a60-12eb-422b-b864-06b589f1d392", "value": "T16E63E886B981CA15C6D452BEFA2E118D33132778E3DF7213DE106F157B8A82B0E3B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498525, "uuid": "3af0b466-2e9a-4b66-b446-8799bbada5cd", "value": "1536:mxnIVMXNNS+QeWr3RL7oqGRa4gVEAFKT3xbMjiVr6hnRztug7R:mXfS/TRL7RGRa4gVE7r6hnRztug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764498525, "uuid": "793e2baf-4c47-43c0-bb49-591db261f4ce", "value": 72028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764498525, "uuid": "7cfecd1b-4195-41c9-8547-64df9a4f073c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498525, "uuid": "5733e91f-e569-4288-817b-1ab891fada28", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788dd29b-cd8f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764467653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467653, "uuid": "fa2fda2b-3324-4e05-80f6-ea67149b5b51", "comment": "Malware payload (AsyncRAT)", "value": "2ae734f7ba08ad957dc402cbf8e066a3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467653, "uuid": "4d9ece79-8a24-4e85-9c68-fc5a7136fae5", "comment": "Malware payload (AsyncRAT)", "value": "9de5fbbf514b8c0d56c5527fce70e9e5eb91f50ab72ab156d29b35535c8f2a6d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467653, "uuid": "df536f31-b67d-4c48-9330-0fd1b2f02470", "comment": "Malware payload (AsyncRAT)", "value": "9f7237f619bec26c47fd0eb2f93e927326d05a77", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467653, "uuid": "c1eaaa16-8912-401d-83e9-9a68860a802a", "comment": "Malware payload (AsyncRAT)", "value": "9dfbc581b1004c2f16c2d660523c9e6bf5d5b6efecd94fcaa00193b64656b61f016f87b05250e38e491ace83d78e2755", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467653, "uuid": "04d505a8-f595-4c40-a698-3ad2db0dc5b0", "value": "T184F23A48B7A14222D5FEAFF959B2A1460674E613DD13EF5E0CE845DB1F27BC08E013A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467653, "uuid": "c58d2c98-52d2-4bb9-b056-cf461e9b3dea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467653, "uuid": "34885a0e-bb6a-472c-a76f-ea4e554c1ce8", "value": "384:dJmh6jJkp49fDuEP37zPbQm2/noL+vAMsfQ1RYpkFTBLT39Y0ZwRJziKUV+is2UZ:jmkX9FbQmgnM+XsfmJF19LWO/hzn/7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764467653, "uuid": "18196e33-4e05-4b6c-bb65-6568b606a9d7", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764467653, "uuid": "b2582028-9665-4e6d-b0d9-1da22cbecd30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467653, "uuid": "a873987c-f16d-450a-834c-8db592f25ce5", "value": "xano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab9a781-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540161, "uuid": "62d020fc-4ac0-424f-8944-b9837d27bdfe", "comment": "Malware payload (Mirai)", "value": "65f6be04143875e2d399a612d3962305", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540161, "uuid": "6a6c0dea-5176-4241-b862-71ed1ee4fae0", "comment": "Malware payload (Mirai)", "value": "9e23d107b22984af9d5812c3fc372e0f2b954138f4c6b33a1d47b9fc9e76dc95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540161, "uuid": "c4ffe843-94b3-4ac6-9fbd-3ba2fa93c4d2", "comment": "Malware payload (Mirai)", "value": "39fcc022ce777aa25b6c8cd7a4fd07dea2dc0789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540161, "uuid": "6726d79f-1665-40fb-8a53-4e3aad480541", "comment": "Malware payload (Mirai)", "value": "9ffb7333068376e739f0d1ee6164ccc01cc274adc0d64acb382e91c02624468d5ef52774507cd3dba73fe80113c72650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540161, "uuid": "59bd6bb4-6077-4927-af6a-ce2b46e64cc4", "value": "T1DCA2D125D345AEF4DFEF9D9052C1C2C276F543CA378AC8E340EEAF016916046B788D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540161, "uuid": "ade9c7b6-3874-4ae8-a180-df320ee70658", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5rAlM4uVcqgw05VxJh:MRxsSVsMD6xiJJE5zRWNt4uVcqgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540161, "uuid": "4a2684de-b0cc-4a75-b39f-fd53cd861b27", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540161, "uuid": "378a97aa-4838-4e91-aa26-eb5c29d617e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540161, "uuid": "a128b6fd-3924-4025-a976-84fafa4e3e87", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3707df05-cdab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764479569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479569, "uuid": "dff0c4cb-bdef-483b-9fa6-33f5eda79063", "comment": "Malware payload (Mirai)", "value": "433bc9b1a0099c11d48a9a4432adc6d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479569, "uuid": "d7d4b588-df3e-4984-aa49-219b6ba875e0", "comment": "Malware payload (Mirai)", "value": "9f88696894c7bc6aa693e9d0133d392f02bb33ce14612bc68fb89b46ee5f2206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479569, "uuid": "d31db067-4b4b-4d40-b51a-d2f7969e5353", "comment": "Malware payload (Mirai)", "value": "046b6e96b4e3db0579aebcaeebeac145873949be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764479569, "uuid": "fb024148-002c-48bc-9a9b-2e669af174ee", "comment": "Malware payload (Mirai)", "value": "36078a8020105ad274353775899ba770d476b08fb7a3ee21ad0400dd631984b7b28f903e0efad80fd945648a266dab62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479569, "uuid": "cb82e897-1100-403f-a9a7-7b0248aee21e", "value": "T164145CE3FC01DDBEF81FE77684034819B230B76114526B3622A77A6B9C3A0595973EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479569, "uuid": "014f9215-177d-4579-8355-74eb072d5b23", "value": "3072:6LY1TRvpw8VPqRCzZnUHTc6Sy3xMsVmemiqTdiZyOVwjbiHLy5jtWly3:6L58dYR7Sy3GsVmeUgZycLEwly3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764479569, "uuid": "c7c29486-f68d-4357-a7b3-a333c7b33796", "value": 190988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764479569, "uuid": "23d80b9c-97f8-4c56-93fd-7e3e69a9b922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764479569, "uuid": "8250061f-7a04-4373-a88e-ad0a357af89a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60847b30-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494241, "uuid": "fab70aec-36fe-4639-b9d9-43f62744cb25", "comment": "Malware payload (Mirai)", "value": "7315275c3a597e1c7f55a48600581bcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494241, "uuid": "9ee859d4-e2f2-4c5f-836b-e5fefe39dcf3", "comment": "Malware payload (Mirai)", "value": "a0a63ffbfdd851a74d84478dedc36b8e4600884bd21485b9be7e8d34beb8065f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494241, "uuid": "af4c2f55-ca2f-4cb7-8ade-d59e49355dbf", "comment": "Malware payload (Mirai)", "value": "9be0eceeda06c85a3d6da64058a673bb54285324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494241, "uuid": "9f216d3b-8438-43ba-82c7-c2a5cfa8811b", "comment": "Malware payload (Mirai)", "value": "f8ced988e50b2c468b0cc3e3dd1cd71b5c8d05b628ff84547a5e006ddbb8a17a10d33eeb027e9e2923cf35bd6ed779f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494241, "uuid": "a25dc832-637c-475c-b3cf-654c11635dff", "value": "T1FD531A92FC424A2BC1D402B6B5BE5A8D376213F9D1CB7227DD614B407BC5A1F0D6AEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494241, "uuid": "f352a7b4-24ce-4126-a3bd-d2071dd53294", "value": "1536:AkvvADrAJ9yAPw4+x60GgxDkRucdHHmo1IEwhg9y2IymQY2AUm6hh1Z/C/C:AooDrU9zo4lXC6hh1ZKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494241, "uuid": "83b8441c-2ace-4129-bce1-93fb0e1854a4", "value": 63820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494241, "uuid": "5fc2ee1f-f868-4505-9924-b10d482cc6bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494241, "uuid": "a9ded1c6-17d1-4a35-9a16-5b6b137159e4", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62b92b5-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468293, "uuid": "91b1d5ef-379b-41f2-b759-f0648ddff550", "comment": "Malware payload", "value": "83aaf896caef0413e642675cf4664e13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468293, "uuid": "f9616812-d3b9-46bd-b063-289e6d172422", "comment": "Malware payload", "value": "a0feee6c99d9f38735f953d91b7675b5f664890a9b24f29a0e205c0da52c7c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468293, "uuid": "dba0c158-3b68-4d1f-b3e8-8b426b35cee6", "comment": "Malware payload", "value": "93909f211306b2af8b0b347237e0eabc2b3c86ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468293, "uuid": "5d6d9af0-7390-49ee-859a-2efd368a3ceb", "comment": "Malware payload", "value": "05ecaa6776c16720ec7469e2dbcfb61b9cc6f3f4206d08fe99d0b11bd81850198dabe3c599827caa71a5472f57a371b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468293, "uuid": "3951cd47-bb0f-4801-a362-15db9a0583aa", "value": "T1B02617137B1CEB0EC61832305DB2EA9427691C8942DB9617B385F719F9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468293, "uuid": "13579fce-dfe1-4922-aa90-7d68a613b465", "value": "49152:MOqs2fvYzDJzmNtIDbpfQWRweFdulyUaPt5EH:Qo4WcsU8jEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468293, "uuid": "4079f53c-3c78-43ab-b027-9eb3eb99df53", "value": 4587735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468293, "uuid": "a732351c-bc78-48d1-8089-10f4feddb8af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468293, "uuid": "c2e88b95-edff-4aab-aa11-27b9c767ea40", "value": "bizy.mipss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10c64a9-cda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475157, "uuid": "b24f08fe-8c3f-4ff7-8ff1-c784e4950fe6", "comment": "Malware payload (Mirai)", "value": "6340a3b4ca49eff079c2c9540791b5d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475157, "uuid": "b6e9d303-2c6e-4d96-bc6b-f9d20473eefb", "comment": "Malware payload (Mirai)", "value": "a124f99b027b0b047dbcf9c9ccf7d4e8c7dcfcff90813a1f2c6707f5bd9e3519", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475157, "uuid": "4f876395-8f52-4da4-84e1-d5318948390a", "comment": "Malware payload (Mirai)", "value": "377e4b23f85ab956f2057e45f9b870d96fe5ca2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475157, "uuid": "4a5483f4-0308-4b31-8e10-21b2ec424db9", "comment": "Malware payload (Mirai)", "value": "a06229591cde5900c58b3798f6bad3c11a0eeb2eb98c907b4f90386d3a9819d1ab70dade39a8e7db90d7033144dcdb36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475157, "uuid": "418f0490-bb3b-45c9-82b3-0156f94206db", "value": "T164040946B8818B11D5C423BAFA1E028D33172B3CD2DFB2169D146F257BCAD6B0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475157, "uuid": "e870bb9b-4598-49b2-a2cd-4004887d4442", "value": "3072:mVxJEk1pGKb30pQbUtoWeOXIB+9cQaztRPDR0z47v8U/N7AQ:LKb4qOCOXqClazPt0zi9/N7AQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475157, "uuid": "62b392df-29df-45d7-ba06-39ec37111378", "value": 182320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475157, "uuid": "9ae2e880-e2e6-4c04-b77b-1578651bfdde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475157, "uuid": "0f24fd04-7a92-4b14-aae3-a641b9954e5b", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64454d86-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468048, "uuid": "bba80858-e098-4808-83ba-4abd67a4c934", "comment": "Malware payload (Mirai)", "value": "0d2b54d40f460c03ba71131807900d1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468048, "uuid": "ad85bb9b-6322-41e0-ac75-763a49532243", "comment": "Malware payload (Mirai)", "value": "a18d5070611e2965db17746f859bc5bd975c799b8c5bf45ade173721acb4ba2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468048, "uuid": "c5df0ff0-b132-4c52-8ab0-84397b177414", "comment": "Malware payload (Mirai)", "value": "da9c554c56bd865cb915264b41e0dc3e41ef1225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468048, "uuid": "1df6e116-92c7-4425-b186-e11f8bcff199", "comment": "Malware payload (Mirai)", "value": "d6d219d9703dbc4117842d7f1b2b50cd23fa2d3739f4b7080062b3684b6173742a1f94c0650df63c8ca4c9da4a0ec9fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468048, "uuid": "626a8c28-103b-472d-9f0a-4e1f19199709", "value": "T150D35B66CC29AF59DA64E5B4F031CF792B93996081471FBA14B7C2B48083DCDF6193B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468048, "uuid": "7000a205-7d57-4128-a123-b5d0dd0263be", "value": "1536:4YaFhFK/NTAnmAATGRbydClKpfRR7w1SvJQ6NIi5W9fnj2rEsj+AJ:sHFK/F2mA1edxpL1vJQWj5W9nkEu+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468048, "uuid": "323bb0ee-9e48-4274-86f6-95493bcb763e", "value": 139100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468048, "uuid": "14ede448-536f-4746-8dbb-659660ea4804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468048, "uuid": "b797d6c6-bf73-4679-b66c-2bd1401a9ebf", "value": "irannet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d0576e-ce3d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764542226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542226, "uuid": "df6b251c-0523-4970-92a6-1f12b136b80c", "comment": "Malware payload", "value": "3dd70246ab7e63f45847a9b7254c7347", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542226, "uuid": "60fadad0-22dd-4187-8508-42932c3b3ce5", "comment": "Malware payload", "value": "a3008bf4399b1b93db815c4a9187e9de9757b34db78a11a6382caad4eca6b9e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542226, "uuid": "3240580e-e74a-425d-a603-3c359e70684b", "comment": "Malware payload", "value": "37cb9201beebe5e2f29dc3c96b06bd09e0b27c69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542226, "uuid": "6958aa34-0729-43b8-aed8-a4fdaab62318", "comment": "Malware payload", "value": "3a5363840fd18518b51ac77c2cd2b4bb06afd38504a39db39c8b5e3e12a9c2736a7ba02eaf4b934eda7b877d623ccf31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542226, "uuid": "6e5fbc4d-c20c-4da0-816b-1b80c16e5747", "value": "T17351F8F8286066331442FF847373C959B80FF9C71D928E786CFE19A9C57B90CE4206A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542226, "uuid": "c1f6be0f-1e8c-4a4b-9cb8-896908ba71bf", "value": "48:QvZi4whPak16YVFUQ3acHn+NXWT6yvGH/rH/Q2TcJPpP+bZ3zpbTxRiKlo6DBusl:AZiNak1FVFUKacHnEXWT/vSzjTcxRdCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764542226, "uuid": "a7b3f1dd-c722-41b3-8622-f969456ff37a", "value": 3095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764542226, "uuid": "4c9e7d9f-d724-4de3-87be-10a5902709ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542226, "uuid": "b22c4c76-0f87-4323-bcbf-35bf0956e1b9", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f8071b-ce43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544770, "uuid": "80d5a2ba-0858-44c0-8149-d79dcb66e0fc", "comment": "Malware payload (Mirai)", "value": "64466a13dae7f91e2978dba016fc4300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544770, "uuid": "a03ba801-5600-4aad-b0ae-154b99b8ac86", "comment": "Malware payload (Mirai)", "value": "a59555a7191d46266ad69abd98e66b7344a7612b1d0d31c55a70e6a388db92e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544770, "uuid": "6e9b18c8-4b19-4960-84d3-d52a4299b729", "comment": "Malware payload (Mirai)", "value": "18ed32aafe3a5122fba2d269b89ed71d05cf049d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544770, "uuid": "cda7b32a-af3c-4fe2-94cb-a028c02afff7", "comment": "Malware payload (Mirai)", "value": "2b620375befeaac731f93ab3e0f833726330741de6e2cef2e828ef38642c06affef5a19476a1e60ea5c5c8ca5899bffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544770, "uuid": "0f22c740-4a68-475a-8485-99aa41b0e3cb", "value": "T1A0A67C4BF5A358ECC09AC430475FD663A931B89542317E7B3694AA342E77E305B2EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544770, "uuid": "6d3ae256-9a4d-4a50-84ab-3a1c483b1d09", "value": "98304:Nht8KrBIe6uK1JcVb28DTYtxeOmJosFNQ98s9PEqlWmEfpIawQW0OZkG4ckRUa3q:N8uKpE0SUa3Gn8gMB+5qNnIFzAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544770, "uuid": "de91f026-1be3-4279-a8a9-ef26a5b98fb4", "value": 10171080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544770, "uuid": "155e98eb-915f-4abe-b1f7-b859d553bd87", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544770, "uuid": "0e9987d6-e2a0-40be-a324-a2780229a33e", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e5b1ac-cd94-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764469908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764469908, "uuid": "aedec85a-c84e-4a56-a511-506e4ca307db", "comment": "Malware payload", "value": "edf42f83998f7ab9ae13b6a5836a46b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764469908, "uuid": "9281235f-6ae5-47ff-9ad7-2b78af59838d", "comment": "Malware payload", "value": "a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764469908, "uuid": "4ef6c83f-b141-4e32-b8a4-28fca43d227b", "comment": "Malware payload", "value": "d96f07908ff11e57bd94b959c0dffc6590aee25a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764469908, "uuid": "3972aea5-79a8-43aa-b618-3704b8561ca3", "comment": "Malware payload", "value": "e5f16579d3560b07b2e4e743a32b33794d105140f5606298f4070824f97a8820fb548e9a7671badc83343847223ddc50", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764469908, "uuid": "eea07c77-09ae-46b7-b96f-fa27770e1a4e", "value": "T1DA94D69067F94604F2FF2F79A9B245114A76BC93AC35D34E098694DE0EB3B81DC21B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764469908, "uuid": "1f699e4f-454c-461c-81dc-ad964c1ef453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764469908, "uuid": "0e9083bb-75b7-4a5d-b4cf-3aee54fa1e69", "value": "6144:VPJiQz7AGn4oXNJA91sL59j17WimTvpqBZi4PjAuMofwa50qHY9bHLMgdMN5A:2QzLnXA9qLJ7WFm/jT50ty5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764469908, "uuid": "9fa698a4-c3b6-4b2c-ba75-8d369ec5b07f", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764469908, "uuid": "77a7c5d4-fb73-4543-948f-62c5c9c89d1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764469908, "uuid": "14629c8c-5dd2-4b4a-9c90-362419c75e00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b156cb-ce24-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764531746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531746, "uuid": "f546fedb-5ddf-4014-96b5-1ec514b21dca", "comment": "Malware payload", "value": "45846f2e8ce91e77b008bcc69f092640", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531746, "uuid": "ea3fd474-2ce5-4253-ac25-61607d1a29ae", "comment": "Malware payload", "value": "a8faa2960ae08620d7428ebb0eacc20c55afff744a697bf0c456244361f0ab47", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531746, "uuid": "ecca0833-3bf4-4adc-acb5-39c9d1526e06", "comment": "Malware payload", "value": "4db7532c4f632bb64914aa4d54d006df6085de9f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764531746, "uuid": "48478800-f4eb-42bf-aad2-f4dfca0c7b31", "comment": "Malware payload", "value": "ab8b09c2cb64ae2870a483e424997af636629969ecf9a997e55db1fd2bd9ea8fabc905bea209d5cbdfdb6e90388e9beb", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531746, "uuid": "f5d86ff8-5b99-4643-aee2-ccfd0cb783c2", "value": "T1E3D37C213AC5C072E16221748EB59BA6467AF8320F7164CB7BC9076E5E382D1DF3539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531746, "uuid": "7ee76938-422d-4d29-972a-ab3c853e4017", "value": "1a3f1cbb2d56db3a2dcbcf0ae35a1099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531746, "uuid": "ddd89477-9f5f-4e8c-9910-0101cc9ccf73", "value": "3072:gblsnvw92lwNrf1qztV2/Q+c0Q+Z7yJ4MShB9GXzGq:nnvwE+9qz2/Q+1yiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764531746, "uuid": "768705af-65cd-442a-9f02-76f1006587d9", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764531746, "uuid": "fcdaa39d-5997-43bd-a854-93971bb0d2e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764531746, "uuid": "42071679-2617-4a27-bdd0-cb9396deeca1", "value": "wininits.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0a9f61-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540167, "uuid": "b5c1862a-f99f-46da-b191-420903183a13", "comment": "Malware payload (Mirai)", "value": "c5b9b2daf8671534ad0f702b9a977227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540167, "uuid": "1ba310dc-5156-4606-90b4-65cde8de2a3e", "comment": "Malware payload (Mirai)", "value": "a99550c419b1106e5e9efc93a0fc2804a0571700db18dda691c9af0b682b95ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540167, "uuid": "e78b4686-1e10-4ff1-ae8d-235b70eb800c", "comment": "Malware payload (Mirai)", "value": "6d5f8627fc5e566562f96dbccf2019a49617f54e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540167, "uuid": "5687c3c2-4de0-46af-a22b-2666f511b792", "comment": "Malware payload (Mirai)", "value": "4aca9633f4f623fc2e006b77975fc749585b5499b0f1c4a553002085d404c896140e9da00ac7993ce32f381514212452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540167, "uuid": "021a0f66-e0a1-4826-ab75-6e27093807aa", "value": "T130333BC5F783D8F2DC5305746077FB369B72F1E91218DA83D3E49A36AC92602E506A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540167, "uuid": "ec32dac2-354c-4b85-b468-a5dd9ebea715", "value": "1536:4r1ro2poo+aZ5RLyTz5RhnYwjHPzsj0rkMl:4r1ro2poofDuz5/nNjvojFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540167, "uuid": "952c9104-7a28-4d5c-a810-4492c191fef7", "value": 54352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540167, "uuid": "5b92e182-666e-47ed-92b9-561735d13d26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540167, "uuid": "66c5d1bb-1b60-41a7-bf6f-69cb76c913b1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44c675f-cda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475135, "uuid": "50161a30-ab0f-4429-8d18-68b3e005182c", "comment": "Malware payload (Mirai)", "value": "e13a61420568eb596224ff8e48ea415a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475135, "uuid": "56e6b7ab-ba80-482b-9f59-90613b23b2c6", "comment": "Malware payload (Mirai)", "value": "aa315ec8f84aa33b84b7c920cb9b9f91a5485321ce16d198efec1abc604f8e3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475135, "uuid": "4948623e-6fb1-478f-87da-0c39e7825314", "comment": "Malware payload (Mirai)", "value": "cde34c29f3b6821e2836ef7903a120fa5705537b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475135, "uuid": "070adc45-5b3c-45b5-a85c-5a36db4f2bd2", "comment": "Malware payload (Mirai)", "value": "c9951d58d06db299c476794b81314d63d8cb03c31bee38387c361e7e7fb2cda2dbf0665e496c14489d9b77bfa51d702c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475135, "uuid": "11637805-b9db-4846-a33d-2fc7da32858b", "value": "T1B65302F922014ABFEBF56B321161F3A66379CD95A2A30E487203F8C2C8D558720B5DD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475135, "uuid": "1c0d2968-fc2f-4ee5-93c4-eba59595c212", "value": "1536:MueAxSvzLEeWE1c8YnYZuTf0IntWHPn9L6pVDiVSJ:GAxSrIez1cFTsrqVDiVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475135, "uuid": "1849ee6c-a0cd-4e1c-af7c-7a8b4526b79e", "value": 63092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475135, "uuid": "47ea10c7-7d7a-435b-882e-c6416110ecfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475135, "uuid": "a03890e0-8ad0-4cbf-95fa-6c8e2a875377", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b52dd29-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540135, "uuid": "b876674f-52c3-4490-bd81-82611bd3caf9", "comment": "Malware payload (Mirai)", "value": "bd7b227ae2b2593a95b7b6fb7ec60f0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540135, "uuid": "2b8fa6ad-6e3c-4688-a00e-7dff85d11109", "comment": "Malware payload (Mirai)", "value": "aa42369bf9c2b2148f201fd19b5a908af067e020fe8f057c8f7f47050853e8d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540135, "uuid": "2626601b-9f36-4585-a540-ec8fafab6606", "comment": "Malware payload (Mirai)", "value": "90f21be783680557f95f191d551eeab6333e2c62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540135, "uuid": "6590df99-38e4-4f1d-b58e-917c7ea0bee0", "comment": "Malware payload (Mirai)", "value": "345117220051868664795f9b2d3726615d71db5660889807c6947b1477b0091cd1348716829a5ae84b043212b4d09510", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540135, "uuid": "c56acdc4-7108-4d06-9a0e-895fb11b0871", "value": "T1A9535C02F31C0E17D4A31AB0253F5BD197BEE9D022E4F685751E9B9A96B2E321181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540135, "uuid": "75132baf-550c-47a3-a952-c4e5de0dd39b", "value": "768:6I+2ZzKKjBoRQCRRAAnmJiNxr52QGBxWCWy/b69Ru7avgq7xN58qFV+tBHwWOIP:T+33FMiNFsnWCURue4q7xNmO+DQWOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540135, "uuid": "1d442378-bea7-4373-9a88-30d80567a3f5", "value": 62876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540135, "uuid": "ad16684f-4d97-4725-b049-4242c9611349", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540135, "uuid": "e3a04f2f-41af-47b1-b31c-e512eda3b1fc", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3294d4f4-ce28-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764533249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764533249, "uuid": "e6347047-d3b7-47bb-9eae-f52a26593217", "comment": "Malware payload (Mirai)", "value": "2912abe72486e7ef791ba6548dcceea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764533249, "uuid": "dc59d88e-2b06-4714-9a31-7878e57548d8", "comment": "Malware payload (Mirai)", "value": "abe2064362ef88d63877b73712abe382399cfc7f74dfd728b9145eb416c61127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764533249, "uuid": "3624418a-b37c-4f55-a289-80e796485377", "comment": "Malware payload (Mirai)", "value": "320ca03f14c509f2d040db96bf0551590778cdf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764533249, "uuid": "290561d5-faad-434a-8682-8aa0bacc0744", "comment": "Malware payload (Mirai)", "value": "7870cc694afce90f0bc90250b7ec3209bdb8502ad59245c864ee27831ece8b1c93a511baac621e7d74f09277aafef353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764533249, "uuid": "a52454d5-5941-4775-85c1-a44b7bae6ac8", "value": "T14D3319C4AA03E9F9EC1549752573E7339B71F4351079EE83DBE4EA36E842B01A60729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764533249, "uuid": "d609a35e-7d01-468f-bdb3-3eb5e0fae20a", "value": "1536:7cXLFHwQy+nkjAWVwwNNImFb9cHtxV1JWDm:kLRJy+nPW9NNImFb6HjVXUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764533249, "uuid": "ee3f619c-30be-4f79-ac18-b373795595a4", "value": 51956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764533249, "uuid": "291d1d4a-8c27-4acc-9013-6d59ba770507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764533249, "uuid": "77e81256-223f-4e56-97c2-47ac9db6526f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7be6950-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468296, "uuid": "0e531148-f725-4919-bbd2-c4c8c4f23823", "comment": "Malware payload", "value": "19e2c4bb4786c18544b182ca18d57667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468296, "uuid": "4ffc9799-84cc-4eea-81ed-b1e927223454", "comment": "Malware payload", "value": "ac2ff7e02b7a162554b3567a0324cd0b2022fcd83bf71ac7847fa3691f789d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468296, "uuid": "095360d8-4165-47da-93a9-9997dee01a00", "comment": "Malware payload", "value": "82e93d94a54e99997bb486c1e7210cbcc098fcf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468296, "uuid": "3615de7f-b945-4f7b-b59c-3662f8af4945", "comment": "Malware payload", "value": "e59e539894349bc50782600101a5a1f88db60854c42c29da8302de82e0080f7fc0001ea3b59538f0f05d9fd74359de82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468296, "uuid": "a9f3c7c9-0855-484b-8c97-167a97a1d342", "value": "T12226D919EC842BAAC41C9B7494E9C99622B05D140BF14B3676A4FFF9BC762347F1788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468296, "uuid": "1b1052cf-f211-43ad-8611-5fcaf51b6f88", "value": "24576:zMpSZNZMhbi98Fzd4P2uPdHjicD0DMPCvAaLdKtYhkxZuIGzPzNPD0YAzJXKFseW:ApSsWOQNtmkx8/b1DAkseYdjoTS5Em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468296, "uuid": "02fc94a1-e27b-4267-a9d0-8e08cd96ac3b", "value": 4587735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468296, "uuid": "b529d7d7-44ee-41f7-b8d1-2ae4933c38e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468296, "uuid": "c17e2cdc-a83e-4391-aa1a-0be313b4d45b", "value": "bizy.mpsls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1798d7c-cdf4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764511181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511181, "uuid": "650b75fb-0119-487b-b26e-51c9bb5221ef", "comment": "Malware payload", "value": "8f0de311e8dcd566a1792bb9443a0a63", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Trojan.JS.Agent", "colour": "#201041", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.FSAutcik", "colour": "#43B0A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511181, "uuid": "7532c18f-863f-45e2-a60a-80a5240ebf95", "comment": "Malware payload", "value": "ace6fb921923ee96c129eb8edea5d72a95062620240f8eaf86a1972c67fb58c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Trojan.JS.Agent", "colour": "#201041", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.FSAutcik", "colour": "#43B0A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511181, "uuid": "279629fb-c6ab-49b5-b781-73eba15c6ba0", "comment": "Malware payload", "value": "3cd2b8130da2b6ff11111617dd2abf6a3479829d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Trojan.JS.Agent", "colour": "#201041", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.FSAutcik", "colour": "#43B0A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764511181, "uuid": "1967987a-f5f5-47e7-94e9-ddaa49592ddd", "comment": "Malware payload", "value": "4fe770359e303ece98b166a5992b438c93fade1da0e38422b126b1d9d51672b58bdc7039db5202422997093ea34f8223", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Trojan.JS.Agent", "colour": "#201041", "exportable": true, "hide_tag": false }, { "name": "Trojan.Script.FSAutcik", "colour": "#43B0A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511181, "uuid": "463c562f-ea9a-4d0b-9b4c-ffc05851e069", "value": "T1F2845585B7C2B88012875B7A772FB5D6F82E4DE871C8084FE514FCA4F9B9609D6E1834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511181, "uuid": "7ab4a9dc-5657-4d1a-b255-f0fc456c43a2", "value": "6144:cDe+er35jY7gxJcxthaghfnLcy6X0zaIMQ0rOc20aN0jkGA30En+:c6+eD5jY7TraghfnLeXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764511181, "uuid": "31637fed-a1ca-4091-9b19-149a16489a52", "value": 403505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764511181, "uuid": "38ce7d66-302a-4701-ba71-cb6f47c971d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764511181, "uuid": "ecf7f836-d3fc-44c2-af37-3b6b987706ca", "value": "c2a3b894-d934-45b7-b5e0-a9b214906283.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501ec834-ce40-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764543606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543606, "uuid": "d14dbb54-b815-46ff-8bbe-981d46210d43", "comment": "Malware payload (AsyncRAT)", "value": "377ab3b696b24ccd1c727f8fe8f86f8d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543606, "uuid": "5a6d51a8-1f43-4199-803a-96a2c3d3782b", "comment": "Malware payload (AsyncRAT)", "value": "ad1f91a4bd41bd5f8d96037f8626a9985f8e62a65c86bd06e63522ab07a6aade", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543606, "uuid": "5311a20f-3aba-4da9-8094-9b6d80648c64", "comment": "Malware payload (AsyncRAT)", "value": "4672b15ff114a71d79bbe76516c05da0645201a5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543606, "uuid": "bb1036d1-a795-4181-8981-2a7d53eef189", "comment": "Malware payload (AsyncRAT)", "value": "03d2a5045f4496652c7bba45802a9b4c2cdb4df10ea3002f22b5396b35671e3bb1535b88054d337f310e7b02eaff1001", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543606, "uuid": "31a2be1f-58f2-45aa-949a-6dc7f79597e7", "value": "T184737C1C7BE90126F6FE6FB11CF17212CA79FA635903D61F54C9018B1B23A88CE512E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543606, "uuid": "9169d1eb-6652-43ab-9864-987c8a6288e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543606, "uuid": "5852ec44-8e83-442b-89bd-eab47a57bce3", "value": "1536:8AksIaDhkQDT7a9Wz+b2u9tbK6z5qO7g1oW:8AkstlDXa6+b2yP5qO7guW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543606, "uuid": "74fbcda3-86b2-400a-b05a-b0e37305a765", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543606, "uuid": "4b0f404e-4939-4e0b-9fd9-b95eca7d4245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543606, "uuid": "f0b22f6e-94d2-4ef6-bdca-44b8b3bcca0a", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb644d37-cdde-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764501803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501803, "uuid": "88e90970-0cd2-4624-95ef-6ad088c7474b", "comment": "Malware payload", "value": "89da49c2a7ef4a7e6f7f146c56276280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501803, "uuid": "d9a8713f-c297-43c0-bdc5-212d82c68b45", "comment": "Malware payload", "value": "ad4b9fdfffe3121767a8c2dc9c848cec66491e6a8b5dfa90ae6022961c846da4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501803, "uuid": "5b2e6b14-297b-4b9d-bb27-af558935ddd4", "comment": "Malware payload", "value": "0c84955fb7ba60ae06974992e4fe2d2ba824bab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501803, "uuid": "8cab9831-7aaa-4d07-a4c5-847ef4aa85c5", "comment": "Malware payload", "value": "2196ed6892f448df13ff89ca443385e797e5a7a38186599ce101113d2770432a7027614d87c049a80f54d8b6bb51f039", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501803, "uuid": "301cba78-4874-45da-b4dc-c2e9dd330866", "value": "T1C0534B2179396E1BC5C4B87B22F34735B6F2170A35A8C62E7E720E8EFF2065065076B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501803, "uuid": "a1cfff0d-9999-43ad-924a-9e78fc4d64d9", "value": "1536:UTZxESndTDaRQ3Sc72sVZegjBAEoq1CIRHsFIRVHdleQchf:UNxxZj3S0eEot8MQdleQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764501803, "uuid": "65d43fe5-ef93-4e0c-beb6-26ce694c7b4a", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764501803, "uuid": "453f871c-e676-496a-9df0-e2653fdc4f57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501803, "uuid": "52fc6e96-10b2-4964-a12e-93d6acf6fee3", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d499f05a-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468237, "uuid": "c192d023-1ab5-46e7-ad2c-9f9a7ca79e79", "comment": "Malware payload", "value": "eea06f8fb56b2b3551798618afcd4a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468237, "uuid": "0b09e805-35e3-4e6f-86e3-e2b2fa8ae623", "comment": "Malware payload", "value": "aed5c6e6cce7cf522fed6ffb85f0d97bcc9a4a0ee096e2570731f1b675dc7d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468237, "uuid": "36d17103-905f-4612-953a-502dd3301d18", "comment": "Malware payload", "value": "8aabe329a85affaf2af74f0a81ca73a209d201f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468237, "uuid": "9916e986-61ca-4d8b-9f07-ae5276f43021", "comment": "Malware payload", "value": "6da4a515cb24389e4f8841d204c00604373cdd7b2393a3827a005db362d62d57a3d1d80d1bce020921160a7b70d5dfe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468237, "uuid": "7fa45661-2b9e-4bec-ae5e-e1a9346095d6", "value": "T155064A03FC9555EAC0AAA2358A669253FA717C492F3123D73B50F7382F72BD0A979704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468237, "uuid": "bbda3fd5-8d9c-438d-a9b0-910dd5f0f9cc", "value": "49152:tcxMmnimJxe3E2bzPVxGoJ+4bTGzfZGijl1KDpzf5EE:lx8xUnRyAsyp1EE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468237, "uuid": "2549fd84-4fca-4b34-88e5-ec31ce03f5c7", "value": 3985592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468237, "uuid": "91d99bec-da33-4f28-b937-6976f76c0839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468237, "uuid": "db4edcc5-b129-4bda-8789-5c61e9afb942", "value": "bizy.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05de1749-ce06-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764518571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764518571, "uuid": "6e7352fc-5484-40b5-be43-44da36f1b5a2", "comment": "Malware payload", "value": "54245b716f0413ba52a452f054f2af99", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764518571, "uuid": "f483628a-e1a1-47c1-9de3-59f3bf90f3f5", "comment": "Malware payload", "value": "afb047591c776e45161734f734e77ab667118d96a2926a17d5b9f0cf1c1167b7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764518571, "uuid": "ad9b552a-11f7-485d-b713-2a0e3f1e9c7b", "comment": "Malware payload", "value": "4f5d53fafc4f27c003bf559f22c73b8faa261645", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764518571, "uuid": "5902642b-cb6f-4614-af93-34736a666e5e", "comment": "Malware payload", "value": "bab0f83bf156aa6f21b5821ab5148f3006dbe0327ead5e1c4565c9c71580d262d5b6f060df3d1fb0c2b6b8944a8a43f1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764518571, "uuid": "c056bbc0-b5f7-4a87-a0d0-dca839e7e5d1", "value": "T1357331780DCF94E8962B74684ADF8D06F7E58A131A1CDED1BB4C6A903F11428B1FC5E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764518571, "uuid": "14f88a89-618e-4012-987f-2ac65b7c905c", "value": "1536:6sFPwrwBW08v2gh5KUKJPLJUPnxJwHl2GxAj7/:6s48wv2s6PLJUPnxJgl2GWj7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764518571, "uuid": "9c250a16-4c93-48d1-be1d-286fe97dbeef", "value": 76146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764518571, "uuid": "bde32009-91d7-43e4-9d40-8191149cf9f4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764518571, "uuid": "99eaa4a3-ea57-41a5-ba64-d85afe951a78", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdfc54c-ce27-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764532808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532808, "uuid": "b84301bc-3ef1-47fb-ae62-8b18ae43a05e", "comment": "Malware payload", "value": "f9de7e13c6d64d61bf83d330fe930359", "object_relation": "md5", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532808, "uuid": "0157daa1-20aa-4e81-8a97-8ad051b48372", "comment": "Malware payload", "value": "afd4bc108d2feb94bb53048f6dbc2b46614629a3d944f14968c978cc49eb6036", "object_relation": "sha256", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532808, "uuid": "13286e55-e367-4500-accb-ead3d9d95a37", "comment": "Malware payload", "value": "7a023ce2f48e6fc7c44e38d793e7c5fae517ba15", "object_relation": "sha1", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532808, "uuid": "cc32dd1e-ae04-4087-8872-db922f8aa162", "comment": "Malware payload", "value": "f9ed90694c79c51450b3d0b0e80e4f0afb455fa484c6c18888d7f6ab00d727ce2eecf4d6b0d3496ae2dfe6c3e81ea985", "object_relation": "sha3-384", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532808, "uuid": "5c7c9b07-1608-4261-8015-747c00073b21", "value": "T12746BE23B96795A1C70A5736C2F70C30C7E5D7A13753F21B3A4E13465CA2BBA8A50D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532808, "uuid": "dc130ff8-feb6-448c-b9d5-b088b9c9df90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532808, "uuid": "af4f2f4c-4b1e-48e8-bd50-2491e5289d85", "value": "98304:rPl8SHjzKxLjHqvdRDdJMXvBAmm9hXZWWhpVqQHQwvQm:rPBHjzKtjSZJqvBAzhXZWWBJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532808, "uuid": "205e5add-8466-4419-b73f-918e6f8d64c4", "value": 5880832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532808, "uuid": "3f467ce2-b14b-47e3-bc1c-fc893687a046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532808, "uuid": "81fb0501-9161-4663-a334-193b5ca43859", "value": "XWorm V6.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97089649-cdb3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764483166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483166, "uuid": "fb2d039e-7b83-42fc-8dfc-1d5ef039f282", "comment": "Malware payload", "value": "ae7d9bd80d2d3498adce1cde0b2e7257", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483166, "uuid": "0052233e-8506-4e06-9ac2-4e0dc3f8e7ce", "comment": "Malware payload", "value": "b09ebdde32d53b2c97068d0cf2b27beee92b25cccd8c847da60c76d48e9960c7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483166, "uuid": "d9b6ad09-9f1f-449b-816b-91c583fa695d", "comment": "Malware payload", "value": "73bf85de655bc59f826be11a9d1a232f6ac37c68", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764483166, "uuid": "12f882f0-d6ac-493f-b2ed-6230608a5fe1", "comment": "Malware payload", "value": "9f0a0b19b314cf1e2eedec657bb9302ed1a0c961808600a435c625e441db312cd4c7b3e06036fd73afa9913a26112410", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483166, "uuid": "fd7f2c2b-0bf8-41f3-a5ae-9af45c87552b", "value": "T1967363C99BCF84F8D623B8588ADF8C05F7A99507161CC9E1BE8DBBA02F2143952F45D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483166, "uuid": "31437b33-45b5-4345-b19f-390f0e5655f4", "value": "768:YJmZzTvjs85TyMh+KvDw87AGlNZ5mCRh9AGCBMIp+s3Us99p3vWSQj5u3hnFS/3h:LzTvj5BfT5mePWM82jT2ZaTss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764483166, "uuid": "8abf842a-9163-4254-b7fc-9bf2f4c121a8", "value": 76166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764483166, "uuid": "b1fe3e54-7051-40e9-9d45-3e10c25eb278", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764483166, "uuid": "06a5bc81-f2e3-4df5-ae2b-91ab649610c9", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34701ad1-cdf3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764510488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510488, "uuid": "8ad42c23-041a-42ab-81bb-a6f07224f297", "comment": "Malware payload", "value": "3958dcf20e3478141ef0fba1ef1dc6b5", "object_relation": "md5", "Tag": [ { "name": "92-246-140-209", "colour": "#4C2FBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510488, "uuid": "f64c07a6-6d28-450b-ba56-f653d4d89e0a", "comment": "Malware payload", "value": "b1ff53a700887ab481d020d0dcbf65acab50d3419cf37f092519c15ea4218e95", "object_relation": "sha256", "Tag": [ { "name": "92-246-140-209", "colour": "#4C2FBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510488, "uuid": "11b4159b-3bbc-4b90-a6c4-7fb9aaea20f3", "comment": "Malware payload", "value": "a72f603753c5fa932c177d69749838d2441a567e", "object_relation": "sha1", "Tag": [ { "name": "92-246-140-209", "colour": "#4C2FBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764510488, "uuid": "063636ba-5bf1-41d2-9bf0-150e27e9c7b3", "comment": "Malware payload", "value": "c917f253afddcb834c67cd202bea71f1e745ad8019cde6d7593569ad0400c061359edd664a1f9dabc35c3e292192fe65", "object_relation": "sha3-384", "Tag": [ { "name": "92-246-140-209", "colour": "#4C2FBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510488, "uuid": "61958b72-0382-4af9-963d-ba50b02ca3f7", "value": "T10C233A07F25702FCC45BE2BED99B7A67E1B5751803228BDF4340493A2F227D4AB3A611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510488, "uuid": "16cf7a09-8cd3-445b-98c1-ae48d62828bc", "value": "20397ae1d188dc4981e8a5854f7b2c9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510488, "uuid": "a2bb012b-9446-4e7d-97ef-fd2844603518", "value": "768:9Ot5t4B592CN8L5HxXbIyII5XYx1NoMBT2Sr69nbs2:9Ot5859rN8n5InfT/69bs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764510488, "uuid": "3072de54-6b10-422c-9e39-84e3a8fe718b", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764510488, "uuid": "32ac2238-2afc-4364-aecc-3ac1059ece58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764510488, "uuid": "b235e936-f9b0-4a64-bd79-5a30a1fe3fb1", "value": "AcXtrnal.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d652031b-ce3f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764543402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543402, "uuid": "c34af0d1-011a-484f-9ec4-4d7daef3eea6", "comment": "Malware payload (AsyncRAT)", "value": "c03fb17289cf4b7065234e89830998a2", "object_relation": "md5", "Tag": [ { "name": "16-171-20-89", "colour": "#30D671", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543402, "uuid": "af0eaef3-373c-4315-809c-059f68aed83f", "comment": "Malware payload (AsyncRAT)", "value": "b2abe1af5fe4b3891a3dc402af96d3ea32ac5e002370fc263060ff4ce8675332", "object_relation": "sha256", "Tag": [ { "name": "16-171-20-89", "colour": "#30D671", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543402, "uuid": "60026610-6b45-45db-8ec9-56e953593a2a", "comment": "Malware payload (AsyncRAT)", "value": "43f65cef14d5d3339cfafd4196b839d7f7936f98", "object_relation": "sha1", "Tag": [ { "name": "16-171-20-89", "colour": "#30D671", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543402, "uuid": "67d5275c-2c18-4101-b60a-6f5d2b932ffb", "comment": "Malware payload (AsyncRAT)", "value": "cd03dc156f3b5811ca1b99d0c6cc7661131e59e85a7eff3ab2b50fcfed468a1562f6796ec9ba30b574fa0356616ce0e2", "object_relation": "sha3-384", "Tag": [ { "name": "16-171-20-89", "colour": "#30D671", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543402, "uuid": "439b958b-f14e-4749-9e88-dfaa58930da9", "value": "T1B9234C007BE9C227F2BE4F786DF22245867BB2673503D54E1CC4519B5623BC296426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543402, "uuid": "2f58e3da-7334-4232-a808-3d3716cf689d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543402, "uuid": "88a0056c-15aa-4456-ae04-d8a46ad467aa", "value": "768:0u42BT3v1gbWUnUa6mo2qRbdxasQmoItaPI48oj0bdHakDHnSmyCngBk8UMjku1J:0u42BT3Nj2+TQm/j47IbdHRSmu5bd/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543402, "uuid": "e6a5a202-1d88-42ba-aa39-e37c09a6edfc", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543402, "uuid": "7f3c9157-6f08-43d5-b48d-4c0a75810d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543402, "uuid": "1c9f6704-ad32-4796-9e38-dedf48d1d6d1", "value": "McFarmer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f879db-ce10-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764522871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764522871, "uuid": "5c52804b-4d02-42dc-b0a7-1c6086d4e40d", "comment": "Malware payload (Mirai)", "value": "b2d7d55636fcf9b8db7c36784bef994c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764522871, "uuid": "3f2b9d89-a74e-499f-9af1-d1d3ca7f0d72", "comment": "Malware payload (Mirai)", "value": "b3457dbbacf31d2a98471b373e110c1eb0fafcb88f41bc62c8f78025c623f5b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764522871, "uuid": "4f2f8a1e-664d-4070-be26-b538229d0efd", "comment": "Malware payload (Mirai)", "value": "e3291556557604774c5cba0334c60d6800d54a66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764522871, "uuid": "3941a198-230e-40b0-a597-fa640d0722bf", "comment": "Malware payload (Mirai)", "value": "8201531d88d99bda763c7c18354909e725e1963761c9c5ee0893d033927482bf8bb16ce2831138527552278252a0c1cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764522871, "uuid": "a818eeec-abfd-44b3-aed8-25e90c9d2f82", "value": "T1D2430241DB789613611AD138E36EFF24A13C4641F3508D0F0AE55ACDE317A9E7723D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764522871, "uuid": "cd75c88b-891b-4ba7-a4b1-d561f7009afb", "value": "1536:CMiUKokw7kSjA8G38MttKO+5hJfEPj5ITBtVTcuTcUeU1:xiXjGkSU35ttKzvJMPjeBtVvsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764522871, "uuid": "74fef806-7b67-429f-96e5-1c17a75429eb", "value": 60428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764522871, "uuid": "48167b5f-6ced-4933-ab13-f6d82c949606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764522871, "uuid": "c10324d6-f460-48ad-b0bc-1ed231fa8508", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98ba94b-ce40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764543783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543783, "uuid": "1ecf5548-a80c-4d81-8288-569b23b966b6", "comment": "Malware payload (Mirai)", "value": "89ba4ba59dc6d2639dff4720d8d74b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543783, "uuid": "9b05a9f2-6b6b-4247-a423-cfc61e7b3195", "comment": "Malware payload (Mirai)", "value": "b373f6ce9ed451f8a27abe6ec7055b6e2d8abe1d634781530945ff2aafe63ef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543783, "uuid": "cda7aff2-76c8-4739-a088-56941f784ac2", "comment": "Malware payload (Mirai)", "value": "e07b771d7003838da4f45b9a9da82e49b3a22bca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543783, "uuid": "2ebc6611-7726-4239-bb97-143cc68f9320", "comment": "Malware payload (Mirai)", "value": "e68f91a21d6f700cd69f34a4b6096681873910e7adefe1aea4cb26cebd6cd9c64c03a20d583eaf10af4287661056bc4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543783, "uuid": "f87f05dd-92cb-4868-8c3c-df5841d0f914", "value": "T1C123F27D2E45859BE8A744B832921B5019A51FE3D507DCA7A2CC40CFAEA76C929C3CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543783, "uuid": "ab56fd57-efc9-425b-a674-05badb43a389", "value": "768:d+jm/igUe0HCLCO63QTxr4p8mXt+62hHRegsb0Se1UjtP/CkA7s+qqc2JgGlzDpq:dFigU7M6q4mC8J8L2UtXT+giVJu9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543783, "uuid": "e0c271b2-ff32-4c99-b1af-cf49755e506e", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543783, "uuid": "92260e43-21f0-4af7-bf19-1686e7399e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543783, "uuid": "ec3a274a-75e3-4a15-99b6-65e5f600da3b", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29494f27-ce30-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764536669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764536669, "uuid": "60eb1620-c899-44b1-ade7-f96f9e9e7663", "comment": "Malware payload", "value": "d84831cfd7d149760359725ad4c91ce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764536669, "uuid": "18f58ad0-ef78-4391-b6e4-01adcab8480a", "comment": "Malware payload", "value": "b5726c9b90c09c2f4d916a707e4b2d90a7caea7470a2f565a60f78f8b0c70d8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764536669, "uuid": "40556b26-321f-4fa4-b65c-c3bbf44fc6f6", "comment": "Malware payload", "value": "8146ddc9d15754705ee0ca0913446a02176ef544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764536669, "uuid": "58f69832-e60d-459e-b16e-8350477d88ff", "comment": "Malware payload", "value": "3da78c97241986f68c808b4ef3d593d954575eb3791fd5ba8101bdaa1002460c70772983ec48b55483dc26bc3177ecfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764536669, "uuid": "65bbffee-abba-440f-9cf9-11ffc26ac136", "value": "T1E0933895BC829A17C6C0137AFA1E42CD371623E8E2DE7217CE259F22378B55B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764536669, "uuid": "d1974158-877d-4f1c-96ca-598945cdb608", "value": "1536:/X/Szx/rKAcxjPwHXpHMfO8IYCDjwr40dIe6q/Nv630KvDsm7:/XoxrKpxjPsiZie6qYPDsm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764536669, "uuid": "c988ae78-b6e6-4f80-a020-034522282816", "value": 95708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764536669, "uuid": "ede9d16e-238b-463a-8bd3-339dbcd8a12b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764536669, "uuid": "9cedbdfb-9c5b-49ff-866e-e009282993dd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecb951e-ce44-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764545483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545483, "uuid": "d723a9db-e93d-4a92-9565-32a9d132b909", "comment": "Malware payload", "value": "9cd9b54325cf735191e761b72fc4178e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545483, "uuid": "816626d2-a6c8-45f3-853a-49f8adc14b23", "comment": "Malware payload", "value": "b5a30e9de997f23644e445026c57e0b9c2a07257ffaec17f17fb23ead875d86b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545483, "uuid": "3d9366f5-d60e-4bee-bc0c-96d3a5b81bdf", "comment": "Malware payload", "value": "acef338e7f951deeea5402f100843fcbf0b4bf3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764545483, "uuid": "3052ac27-b7f0-4dd3-89dc-7615e592df6d", "comment": "Malware payload", "value": "cbe21c0681c105cdb8b22131fed0cb63f158e2d70b150cc7177fcd2728346ba584a9485a119ead303d0ddc69c2e8003e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545483, "uuid": "b1771a6f-7d4e-45e2-b6ca-aaf541cb0645", "value": "T19804871A2F128F7EF269837047F74D35976976DA26E1D684E1ACD5002F202CE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545483, "uuid": "8a8f23f7-f0dc-4802-8c0c-38fb6531266f", "value": "3072:AjuwkS8IoCFPgzeErWtd9NeltLAWMEl6Bph7Fu:bwkSJoCSzeEecvAKlCphBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764545483, "uuid": "6d7e0848-7dcf-412a-a848-c9320771e33f", "value": 179572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764545483, "uuid": "8154d201-cd66-4035-90ff-4dbcd0d7b8cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764545483, "uuid": "25975138-098c-439c-aa49-dd7911de3b08", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71af2e58-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540226, "uuid": "54047255-8692-44f4-bfd2-322dc58a449d", "comment": "Malware payload (Mirai)", "value": "fe44b0d75113044521aab4b36965c4e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540226, "uuid": "e70168ab-d2f7-4f5f-9d02-b814a8cc8696", "comment": "Malware payload (Mirai)", "value": "b5bdaaf7a3c75f484565043635b063b3b75b1039be3c8d795f12f4c74116304d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540226, "uuid": "6a16b1eb-d793-4aa5-80fd-fb1798c93deb", "comment": "Malware payload (Mirai)", "value": "740eac336879388b83b7907a3d97b38de7d5e0b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540226, "uuid": "449c7919-e33a-423d-a52a-a93b29cafbb1", "comment": "Malware payload (Mirai)", "value": "4156eaaf1106e122d285cfb14a6d665e42c789cdd4223d0237d57e5266f9e9614d6a2593af3f5b896e162863c69d2ce0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540226, "uuid": "641988b9-7463-4d56-b4f2-63b6cdff88f4", "value": "T1BD334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540226, "uuid": "d62dfb8c-8178-40e9-9f3f-38f1b4e78040", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Twb:ivW3jdQGqt7Y+Z+zN9cGgI6bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540226, "uuid": "0462b408-30fc-4992-a212-3e86ed0f92ad", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540226, "uuid": "3f439c27-6345-4c1f-a01c-b72e0f1da35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540226, "uuid": "c45ee02b-8714-4127-8e13-8c376eaaad8a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56060d1a-cdde-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764501525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501525, "uuid": "6a42dc64-d2dd-48a7-8d78-34a3ea698ead", "comment": "Malware payload", "value": "afc830d68b9a12373e98f9d6cc8c7997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501525, "uuid": "cdf54560-1d7a-4c10-a9d4-498da54b8743", "comment": "Malware payload", "value": "b61ebf8267279de8e7dc76d831bc4292ca05f9f2766e2c8415b62226759e37f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501525, "uuid": "f679f70a-9923-47fd-ab3c-26342ac936b0", "comment": "Malware payload", "value": "8b181b6baaecc9987ba7496f83ef2d889a97e9b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501525, "uuid": "39285d40-3e7e-4a3c-bc43-61a2ed02d092", "comment": "Malware payload", "value": "16f7ec3daa4f65fd34c7bf23c54a911c9a555c0ce1dcd90ee84a8b6bbab63f3cc0efb1a3a309e22cb61ea31f2843ad84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501525, "uuid": "b1c2b1e6-05bc-4540-b058-f6b54190d969", "value": "T13083B349BB650FF7DC5FCD3B09BA5B04289C950A21A83B767D34E818F64B24F19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501525, "uuid": "b1a555d5-b395-44b9-810b-c5f9003cb206", "value": "1536:8WpJ9eHuNoMDH3GW2g/F4rgwfBnvitp3VTefLTARug7R:8WvuuNnDXGWLF/wf6sARug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764501525, "uuid": "49df3b2f-29c0-4e87-9e6e-bb4cc5df9bb1", "value": 81308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764501525, "uuid": "6ef055da-70c7-44c7-8065-60578891b69d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501525, "uuid": "b7d74f23-83a1-4ddb-8f8b-8ac55b842828", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84e5cfc-ce3d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764542573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542573, "uuid": "d4628254-73f4-4a82-b9f9-d00e1518546f", "comment": "Malware payload", "value": "38bb11ab5e961187b2c9217d5d47d719", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542573, "uuid": "e498d1b5-30fb-49bb-9a0c-f03815989020", "comment": "Malware payload", "value": "b6c6444ff9ea6766d5465c6c94941cfe0119f91351c337d29ddaf1a240cc94f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542573, "uuid": "1b18e9ac-44de-47b4-99c4-593410954a1d", "comment": "Malware payload", "value": "019b32475b7012c20001af3b30147ccc26ac384b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542573, "uuid": "4941e8b7-8273-4034-abfb-829e34cc497b", "comment": "Malware payload", "value": "d81b28b50c56124f3ce6ea9c4c80c2ac2640e3149ed11cb0875dc61d6f3951c0ddad7afbb058f0a255f4b856f6e65cc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542573, "uuid": "bee3c836-8158-4fd5-b4bf-d36ddee9e670", "value": "T19D6301305803F629DD18A4F9B4D01486639EC9219FCFB84356E2AF6AB4C6E335B37C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542573, "uuid": "e67e4c49-22d9-458f-9a22-f3e6a6aa31c7", "value": "1536:ZsZ+ja4ClqTKxKZyv15gBEF8/rblzUICLzn8XqTaV:mZmm7Myv15gyaflz0Lz8Xm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764542573, "uuid": "01b1fdca-8599-4e5d-ba32-30c597925b35", "value": 66736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764542573, "uuid": "8e76bcac-9270-4087-b0c4-a5a34ca676ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542573, "uuid": "4b7d874a-5fb5-404d-bafb-3e896bf88b2b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6166f3-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764540162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540162, "uuid": "6a747362-d2b7-45b7-a610-951a9ec87d90", "comment": "Malware payload", "value": "5c8683344cb31b9c2ce566c5b99d43a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540162, "uuid": "21689b81-6d14-40b5-916a-0ce7b51ca298", "comment": "Malware payload", "value": "b739643b4aa2e047710ecace427ad1808ebd658428b8cd932a990876d591221a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540162, "uuid": "342df081-5138-46eb-a5ad-ebd9a1f2b21b", "comment": "Malware payload", "value": "ed83cbde3544d6dcdbb67a9fcba54e50077eb185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540162, "uuid": "d09d9e7c-4832-4486-9492-37abfbb6b90e", "comment": "Malware payload", "value": "d733e0e1b62b034aad4c58b93670e0fea17699a07597b72252d692973c4c9152be08e3dcaa88f62550b12bf0ecafa9ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540162, "uuid": "f9bbf2dc-3eb0-4ec1-92ca-4d5f81a15590", "value": "T1A5339DA2368C10F2E85418FD4A2B29B897485AB3C9A0C743BF5A377C1DB664C6F057D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540162, "uuid": "10013e34-d8f8-420f-8326-69b86d5e03e0", "value": "768:Om4p4OMI9cnEwfhuysEmzf14JgWjmYlkgx60OWE9YK9E1knbwnCSzFPxI:OuIg7sEmzf1lb7y60O4k0nCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540162, "uuid": "e96bf0d0-4e76-4350-8c20-578afe342b4f", "value": 50756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540162, "uuid": "d5da6ea7-14fe-4801-8fa3-1a80182c0c2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540162, "uuid": "37ef1bae-61d0-4c8f-827f-e3bf4741b3d1", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490beaa6-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540158, "uuid": "a3392fb2-5336-466d-b448-72f58fc351da", "comment": "Malware payload (Mirai)", "value": "9388db58d1f968ca0572501120d27795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540158, "uuid": "dafad198-428a-45d4-acdb-0e8f5ab10954", "comment": "Malware payload (Mirai)", "value": "b82dd5f8e89c39e5327c65d577270cd399ec89103c6a0996d9d28ef85f4e6d97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540158, "uuid": "3843f2f3-2b44-4fa0-9944-2244a7988c42", "comment": "Malware payload (Mirai)", "value": "0157baed902fa58ddedeae02c307868b03f3093b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540158, "uuid": "7c0ad84c-8ce3-4dd1-90b0-35b9224b7406", "comment": "Malware payload (Mirai)", "value": "a78c7adf959067c26e16bb2798407c6e68931278f8c1978633c6758791847a2540db0f3e0cb408ab0b8d848534880ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540158, "uuid": "fc419084-40c2-4aa4-a642-776aa746d100", "value": "T1BA633A31FA761E27C0D1A47621F74B25B6F147CA26E8CA0A3D720D8EFF60A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540158, "uuid": "69738242-cd88-46c4-9b31-65e333cb690b", "value": "1536:k3FxfjvpDFazGvoA/S6+mAQU5Kxb75V4ortutZd:WF8MK6+mwQxbVVijd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540158, "uuid": "e2f9815c-b276-4e18-a518-330333cb6a2f", "value": 66888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540158, "uuid": "d1d1bdfb-16ea-4f0d-90e0-ebd9f358becd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540158, "uuid": "77a0ec12-c792-47a6-9721-efab1d469c13", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c5f255-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490603, "uuid": "d2974338-19c6-4be4-b0e6-33b6437b3c69", "comment": "Malware payload", "value": "ebb38803589f1e42ae1e6e6a745682e6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490603, "uuid": "b5449d13-b5b6-414a-8b1a-b179bdcb7037", "comment": "Malware payload", "value": "b99d175cbe06d4569a18449da044f326c68a56315ccc0da9cfa6f2c33bfd0939", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490603, "uuid": "41304501-f8c2-4a33-bb86-53f9b1af4eaf", "comment": "Malware payload", "value": "383c0965ed7d2292598b4e783f30a88481819754", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490603, "uuid": "98900297-7155-4121-bfed-e1163d08f2d2", "comment": "Malware payload", "value": "2a2f027f410f04f6b3d2f36f5a31512b959604c485430f938d6f04100e0b9946f501ccf1217c974eee2edab38ed4e9a5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490603, "uuid": "bbe5914c-28b4-4ebc-ba2d-f7f81efbce3b", "value": "T1DD762346FA19A51FC4F3D33318B006361076DD2ACB53E79B692973B529BBAE80F452C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490603, "uuid": "a55377fd-852a-4e31-983f-7a9affb43155", "value": "196608:oK27ptHjrPyjlDwYa+eIDG2yvmOh6qPCuKKg/lRNCAUTQMo5e:oK2FtvPeT/DGpuOAqHKKMRNiQMo5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490603, "uuid": "39a13e4f-f58e-4a23-a389-555d16aac928", "value": 7571995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490603, "uuid": "b625af5d-892a-4b7c-a3ce-07eef6502ade", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490603, "uuid": "60859f77-4e0d-4ed1-9440-cefcaf3ec97a", "value": "NaftMan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47dea93-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490597, "uuid": "1bbc72da-4095-4fed-9014-ace31575f8b1", "comment": "Malware payload", "value": "4e2b7184c4118af4bb2b55c119c96909", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490597, "uuid": "42cef31e-8083-4cef-a972-ba1528a40ab8", "comment": "Malware payload", "value": "b9bdb84167be00581ef100106f58391145e2721f272417c54ad6f7a830ec0683", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490597, "uuid": "504d957c-478e-4744-b18b-319dedeb2478", "comment": "Malware payload", "value": "704c10f761b23f138e6c4cab150b28fdcc012428", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490597, "uuid": "e38e45b9-b302-426d-9705-7683d06155af", "comment": "Malware payload", "value": "16c191ef7555fd04d481c8732aeb9ca1d2d57334aa944aa298f16223217c0f93befbc0f352547631d0a22c5c3c5190ce", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490597, "uuid": "043b6c2d-9403-437f-862d-622ecea04edc", "value": "T1619733D507AE0A239E75716384B07597358A303D213F32896E80FCA1AD6FC93F5AD4DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490597, "uuid": "cccc3cdb-6a37-4348-a3f8-10a7281f91d4", "value": "786432:Dgj3IKQVFzsz9BmXJebmztRF7P4pcOOrAaTCBq7h4IM6s:03DWez9kZzH5zOld5Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490597, "uuid": "74a54cbe-f4eb-4580-9a23-bd21551d443c", "value": 39842925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490597, "uuid": "dfdeeb9c-50a1-45fa-94c6-b711e41cd1fc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490597, "uuid": "d2dbf623-f86d-4d87-bdaa-22bc2af44852", "value": "485\u578b\u8bbe\u5907\u8d44\u6599\u5305.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94510905-cdd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764499482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499482, "uuid": "9ece41f3-3d60-46d0-98f3-47e962595c70", "comment": "Malware payload (Mirai)", "value": "9cf8622e77e42061742ba8fa76572892", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499482, "uuid": "a4c42de7-da10-460f-b852-ae43da91fc39", "comment": "Malware payload (Mirai)", "value": "ba5a075a46578af3c7c9cbffabbb1fb2d4831144976880a0f6d4e92cf18ff4e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499482, "uuid": "ffc03e8b-23ac-48f4-9fc8-150b3c7faf82", "comment": "Malware payload (Mirai)", "value": "436bf1d8a5a04583560d59b4a78b21a76ff06040", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499482, "uuid": "5ff3e545-c6c7-4837-b5ff-e66a6a2c90a9", "comment": "Malware payload (Mirai)", "value": "41c4ef96755a3f337ca32362309781449dc010d5adbdfbdd2e24ddf72cca90a4f85f600527dbde0e18682ba90774a50c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499482, "uuid": "592919cf-c4a7-49b6-81ad-bd7aa1646faa", "value": "T1B0C32995FD818B16C6C2167BFB9E828C372753ACD2EE72039E159F61378B45B0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499482, "uuid": "fb3b2bb8-7b73-4861-9853-fa8f2dfd7aa5", "value": "1536:rQ6SsykUOhnKanWKPddagjMdUSo9GsRXNvBSWcWclOulNQlre5OefbIyPF8f+i7K:rWkP/nnPacMpaFB9mOul6rjE6H6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764499482, "uuid": "2ee6df02-6664-4e68-a6cf-15513ce1b340", "value": 120480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764499482, "uuid": "c9966453-97df-4278-bda3-7385b66e571a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499482, "uuid": "d90a353f-49cc-4898-98f4-123fbbced64b", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeed3d69-ce42-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764544624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544624, "uuid": "09495b76-f9e8-4b18-a19b-699617fca945", "comment": "Malware payload", "value": "bf3dd41b4e35a2271c7419369b01d1da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544624, "uuid": "5d8f58d4-d050-4a82-92b1-acf054de0599", "comment": "Malware payload", "value": "ba71d60d747039c62355151d083ed0c847fe9e2613a074aedafba2ec9a27bae5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544624, "uuid": "24c8e0f0-761c-4740-b947-0b2eb5f45b1f", "comment": "Malware payload", "value": "9e1774f07969cb1b372f81ed8d43383f53344d79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544624, "uuid": "ad3d924d-f6a7-44e5-97d1-1479627ab79e", "comment": "Malware payload", "value": "ad72bf247fad4ad17fdaef18e2388d1d9819e98deafaf593b15fd93983fedcd5d8d82c79c8f31fdba05a5c0ceb238ef3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544624, "uuid": "9e9f5bcb-2609-4d27-96f3-debd7ddeb588", "value": "T11673B40ABF650FB7DC5FDC3B09B91B44288C550A21A97B397D30E918B64B25F19E3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544624, "uuid": "54ccdd0a-0e3b-46f6-9c08-d287ae6f5964", "value": "1536:yxVJ+czi6z7Mjnnkf9sXL3LXAuwzuyXW6qu0:yrJ+P6zAjsuXD0qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544624, "uuid": "5dcd87f4-0670-41af-b753-02ddfbd7582e", "value": 76544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544624, "uuid": "ac8455f8-f214-4845-a569-39c5a1d493b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544624, "uuid": "f06a3ee1-d884-424f-ab81-e3aeaf361b92", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaec4156-ce03-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764517667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517667, "uuid": "c8e296e7-eae8-4aca-a7df-6270c2af3160", "comment": "Malware payload (Vidar)", "value": "90c88581758f62a91eab16349f2c455d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517667, "uuid": "f658f8ec-4f9b-4b90-9f11-1391a2bc679f", "comment": "Malware payload (Vidar)", "value": "bb67dd02fcfb4f15cab2a5c9ca947e14b476d0330cc73fb049ede7fb59983653", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517667, "uuid": "ba3912f1-08b3-4dad-b432-016b2b26f8e4", "comment": "Malware payload (Vidar)", "value": "4deecf9f01aea30d4f14fa3789b49f72c73030da", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764517667, "uuid": "9a18d908-e889-4a65-91ac-772dcc490024", "comment": "Malware payload (Vidar)", "value": "6c2c1959e10af6fd21e1e987afe0d1e98801ec7ee95b80d3d68554dbef0614ab623f6a336aa83de1c51485c11a4bb8a9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517667, "uuid": "ebf84ae5-ee50-4eb1-b017-9713c29eae2a", "value": "T1C275236667BA50F9E0F38134C9925646FB76383503915BEF02E083396E171E1AE3EF25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517667, "uuid": "5f63a4f2-5d51-44bc-bbff-964fcecb395d", "value": "00ec1f9addbab7dd7a563fe6fe9caf72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517667, "uuid": "f965274c-c954-49cf-a2cf-52b898f04232", "value": "24576:ycfP+dXSjLTpy/Sjyak1fPwxsK4qjeW2vJ0Ov1Y7phn9xguFBcVAsrRcAyk5x4:zPkXPS+rfPwxs6jJ2vc1BgVAsrRc32q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764517667, "uuid": "3c9bb97b-0736-4228-890f-2e38aa0a2803", "value": 1595090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764517667, "uuid": "ffa72aaa-a1f4-42e3-8e6a-ae5ad47f05ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764517667, "uuid": "4b6fa3d3-ca1f-4afe-9166-7d437b00dd75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a68a67-cdb2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764482488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482488, "uuid": "46a2a1aa-cad1-4c32-92f3-07d80188bf17", "comment": "Malware payload (Mirai)", "value": "95da112df7418537e9ee311a717720cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482488, "uuid": "954a39d9-79f4-46d6-86d9-aadaebdf1810", "comment": "Malware payload (Mirai)", "value": "bcf738a4d6b2794b0c4e0b7e3b48bbef4b1cf9de55b811b751fc5936bfe45b1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482488, "uuid": "daa5ba71-993c-43e0-8860-b18c52d62cbf", "comment": "Malware payload (Mirai)", "value": "a73f4e62d4603c56409ca479127fa9d95f356534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482488, "uuid": "9428f9a2-dddd-456b-afea-8bc80206b2ad", "comment": "Malware payload (Mirai)", "value": "14c4647511ce9f3d879e9e6546e30c27786e49f3b9a854f525df2defe3c0e301887ddba72104dd87dedf199e1294e924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482488, "uuid": "04bf1a21-24f4-4fc5-a3df-fa424c35bc8c", "value": "T12B53028DA45874C3DABC7C364AEF870D962BB28537BCE71A22105C41D77DC497CA998C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482488, "uuid": "0610ab63-27e2-4234-b11f-c35732fd8d0e", "value": "1536:RGBTAyJgOSePr4EMlraRt+89afli1ew4tgeuXbiwOT:k1TFPrforqOA5JnHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764482488, "uuid": "0de820ba-665f-43cf-843a-f84a8b1f3a74", "value": 65356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764482488, "uuid": "ecf7ea3f-bdbf-4b37-83bb-dac526e7a68a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482488, "uuid": "ef450cf8-8170-4baf-8a0f-73a5c985c59c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bf4eb6-cdc1-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764489232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489232, "uuid": "02d486d7-21a0-4069-b5ff-e9d35bec32aa", "comment": "Malware payload (AsyncRAT)", "value": "f418032d5af44090b8fd71ee0cabcdc8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489232, "uuid": "78bfe53d-6ece-40be-b2fe-262230eae780", "comment": "Malware payload (AsyncRAT)", "value": "be6dd4916e4e4595fd6fdab18b1d1e1d3bdc1a25edcc935658ac1fca93b56f79", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489232, "uuid": "10ea1ebf-9939-417c-8253-4b8aedeecd19", "comment": "Malware payload (AsyncRAT)", "value": "2b9e608bf10ab411985a2d3ca1332d9ffe9dd4c8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489232, "uuid": "39a632f3-bc07-4d73-b728-e64938b483e0", "comment": "Malware payload (AsyncRAT)", "value": "0de333c7fa0097099d3984b2ba36429eb1f47444ea2c12337f9d701dcdba0898e7261e165ef7808569e08f510ef8e914", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489232, "uuid": "b25af4c1-ebf0-413d-acb9-3e8a91edd797", "value": "T1E5F23B48B7E44215D5FEAFF56A73A1064275E70BD917EB4F0CE484DA6B27AC0CE013A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489232, "uuid": "7ef7a3ec-51b6-4841-871b-dd571bea4120", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489232, "uuid": "c56ad80f-b133-464e-9756-456fbcd0a0a4", "value": "384:cXQZBWPNkoKt7PjPELbij2X1bJ6iEGoJwE55ipkFyHBLT39pZwgGzVvNV2is06ug:og/jIbijm1uGoD3Fyp90cO/hfyc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764489232, "uuid": "2727cf6f-16e2-431f-9156-68f6d9f4597a", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764489232, "uuid": "37d7b018-273f-42c0-93a4-ed48c60d0680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489232, "uuid": "943ae01f-928b-480e-9495-bf0b127a3061", "value": "program.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ddf273-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538802, "uuid": "ca1e3160-e2aa-465b-a886-37d648b4856a", "comment": "Malware payload (Mirai)", "value": "bea1e33b9184d9f5aca549878d0d7881", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538802, "uuid": "cf071bb9-e40e-41f9-b84c-f30dfacb6e83", "comment": "Malware payload (Mirai)", "value": "beb0d74586468c8e59455cb25a4b00a122c0819cd5cb8954952ebedef65875db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538802, "uuid": "634540d0-c8a5-4d29-995d-d277348638ce", "comment": "Malware payload (Mirai)", "value": "c9edb8ea41b1230ad662fd6edb091ec1e4e83495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538802, "uuid": "bf774021-4d5a-41f9-b63d-9664b8d8ee7f", "comment": "Malware payload (Mirai)", "value": "3a9d61b260269c84ae677ca66ace1a7a90cd90622126a84192c94fe98b7f83eb2b07f4f02651f092901f575a2cc58484", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538802, "uuid": "abb8c956-ff3e-43a7-a608-e5479efd3d73", "value": "T14F343B45EA418A13C4D117BAF5AF418A3332A794D3DF730699286FB43B877AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538802, "uuid": "d0ff7d10-7d4e-489c-9f12-8c3ce0689c96", "value": "6144:LYoHI9SxOBzabKacEK1dAnJd73Hf9ihM/97AU:LbESYBzabKacE62JxYG/9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538802, "uuid": "b3f78472-f37e-4257-8ac2-a45a23ce5ddc", "value": 230960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538802, "uuid": "7c9f08ca-55ed-4a1b-befe-2fefa564d208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538802, "uuid": "c1b675cd-75fe-45e4-8984-d5e6c33c311a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada266fc-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468172, "uuid": "e8a24d13-d474-4ced-a831-5fa2eccbeddf", "comment": "Malware payload (Mirai)", "value": "a79426711ac1b791e15773ed68602374", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468172, "uuid": "6712d8e1-4cd8-465a-8834-6fd5a101b711", "comment": "Malware payload (Mirai)", "value": "bec77d584ebd3438d6cc13880e26ed059392e0633937e0de6409620caf683cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468172, "uuid": "f0a4a1cb-0bc5-421f-aa68-f9e0cf29b675", "comment": "Malware payload (Mirai)", "value": "a3c07bf6c7e74d73e1850c2b96b046d961677816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468172, "uuid": "e3715675-e6e5-4317-afe3-51e6501c31ce", "comment": "Malware payload (Mirai)", "value": "16d8daf52d4fc7f9c7801d8ed7ea9a4b0db29a3cad5530d18e58cef858dcd9610e45b2d7af2f107bc880287bd17c7afe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468172, "uuid": "1f1303e1-278f-4781-8679-7f0433df3c0f", "value": "T1DCC32A06B30C0947D1632EF4363F27E197AFDAC121E4F644256F9B8A91B1E325586ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468172, "uuid": "cacdc190-e790-498a-b94f-0c870edaba5d", "value": "1536:SowNnq/ScfEioNxN2aBE8MEE2y2YWF7bJm2vA+JtqRFZ3xrqbilV5oAz:xJoNxPtHFHJ0+e5oAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468172, "uuid": "b8342ea6-3f1c-4187-91b5-c904c3b3523d", "value": 129716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468172, "uuid": "90e77392-514a-4285-b363-8fc50ca6be25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468172, "uuid": "fd9ffa3c-b4dc-495b-9384-9323b14b7857", "value": "odin.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2ef4d5-cd80-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1764461168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461168, "uuid": "8f5cbcfc-8eff-4b53-b158-f34768bcadb7", "comment": "Malware payload (Gh0stRAT)", "value": "42cbcbafec9b925ab7718e35a62a688f", "object_relation": "md5", "Tag": [ { "name": "cc-kmsccadn-com", "colour": "#E5F91E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461168, "uuid": "7318d7e3-b5cc-4a59-87a8-67912475200d", "comment": "Malware payload (Gh0stRAT)", "value": "bfafd06973daa3a0f0b6f08a9d0e6c2cc0f4eae098e97d177432aecf986e0002", "object_relation": "sha256", "Tag": [ { "name": "cc-kmsccadn-com", "colour": "#E5F91E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461168, "uuid": "0c07c1aa-da32-4f78-a07d-6a768d48cb60", "comment": "Malware payload (Gh0stRAT)", "value": "3967d086da5d1239525883e785dffc824a8e0a1a", "object_relation": "sha1", "Tag": [ { "name": "cc-kmsccadn-com", "colour": "#E5F91E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461168, "uuid": "dd90b100-eb22-40e2-9599-bcd20ffe1147", "comment": "Malware payload (Gh0stRAT)", "value": "0983f85ac9ecd1270c60f48d66bbbca84da3674f183c7dbba3f1e61f79ea192fb337adcc2fe5a15d9382dd96c5de7291", "object_relation": "sha3-384", "Tag": [ { "name": "cc-kmsccadn-com", "colour": "#E5F91E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461168, "uuid": "4caa4863-7105-4d9b-95dc-2e4fb8ba41ec", "value": "T138961212B287C432C59D0177E968FF6E1538BEB3473115E7B7E839AE49B08C153B9A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461168, "uuid": "cea7a901-7d79-4230-900b-2dc56bfa1329", "value": "196608:bbHT5WiATvfHCQ4Uy+K819J7h+gQ6qBjtDR9DUnlKDQQ14rl:bDthATv/jc+7reBRDRlAzAal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764461168, "uuid": "153ea04c-d243-453c-9e6a-c7a58263e2d7", "value": 9420800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764461168, "uuid": "2124f6c7-1797-4493-9c7f-956f9c18d12b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461168, "uuid": "db170734-23c1-4416-9628-8e443eb5d19f", "value": "ChromeSetup-7000.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bd9a5f-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468051, "uuid": "6dd3c635-42ef-441b-b97b-4c213df7be81", "comment": "Malware payload (Mirai)", "value": "fb78b8349098670da5a85e917db2100e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468051, "uuid": "c244aa26-d7e5-452f-9815-cf94511d899b", "comment": "Malware payload (Mirai)", "value": "c13c0884dd95f92bbe6d223768fc66b99c4dcda935e989b9eee10df2c2fe0d50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468051, "uuid": "ac4da427-6cbc-4ff3-b76f-8c74d07aff92", "comment": "Malware payload (Mirai)", "value": "0d65ae8bdef54d3e1ebf225f27f39a88653db146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468051, "uuid": "80f17152-cf3d-4361-a641-a9046b888f20", "comment": "Malware payload (Mirai)", "value": "a19b6f321dd92629b00e65e309b2dd6cf197c65bb5f721bae251f4a2b363fc1624c4ffe568109948485f92827f037841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468051, "uuid": "12cf6aac-5ce2-4429-b7f3-567e501a50d8", "value": "T18C9312BC9C31B0C2C1417A315DDE7C210D9197E4133EB7B828F7A95A9EAE5C9F81A4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468051, "uuid": "20b84d08-168f-4226-bc0f-9ae3fe9787cf", "value": "1536:BnHLuwg3HsLQtOeX8J6WGt4Wobd2ldHd+x9wjpNu+RgrlLa07rd6G7SQrg:FHLuwg3kQ0evWGtmsrHdW+RgjxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468051, "uuid": "a6d0c6d8-4a25-4c96-b9b5-b29841658f9c", "value": 89048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468051, "uuid": "0cc0059c-633b-4b79-b0d0-e23c3165d297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468051, "uuid": "6405ca0f-c8d9-4800-8e0b-091529878481", "value": "irannet.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b02fbf-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540154, "uuid": "50017677-3479-4e17-b8d1-d4bc2a744899", "comment": "Malware payload (Mirai)", "value": "f82a79eff68bbeeaffade08c47542c69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540154, "uuid": "625309c7-e919-4776-9aae-cfa1602375dd", "comment": "Malware payload (Mirai)", "value": "c29b9810ac27f6e7197d50561f3adad65168a85aa1fce0e9205490f49ed9f3fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540154, "uuid": "f513250c-8ded-41b2-8709-924c993f32be", "comment": "Malware payload (Mirai)", "value": "6d3945ac730c08c48229a601ddc61b8d8f4038ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540154, "uuid": "776d48c3-bde9-4a46-9e39-20ee2523003c", "comment": "Malware payload (Mirai)", "value": "6693238b03524992913ba85b5cf7ffa6774e272850c091b8d582b61ba60144fba52d3ab14404d72a94e250036219ff85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540154, "uuid": "00ab3b0e-8a88-4629-8eb2-7575b54f69ea", "value": "T1BAE33B56EA418F13C0D21779B6DF42453323ABA493DB73069928AFF43F8679E0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540154, "uuid": "afebdf8e-dc43-4592-92e8-777989aba643", "value": "3072:Eg5G9TXclhvaNHbz4NdWGJK1Ir1F3nXljRM/9NKN:Eg5GyvaNHbz4NMGJJH3nXl9M/90N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540154, "uuid": "1e085123-f3e8-4daf-861c-fccc2a592f43", "value": 149088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540154, "uuid": "5965bba0-c5bf-4899-9b12-136b7369b359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540154, "uuid": "88611f71-cfde-4b5a-950a-ae3e3e6d1ceb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c75b52-ce10-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764522921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764522921, "uuid": "a40603cb-1ee6-40d3-a60d-571e46dc4b72", "comment": "Malware payload (Mirai)", "value": "2ff977428134d80c88115024861cdc12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764522921, "uuid": "7d3b8308-1780-49aa-a18f-b687e60e4fd0", "comment": "Malware payload (Mirai)", "value": "c2ada55e115ba50e9b7e70c6b4eced5c726ab2ca30ba5dc8aca0d081f3b1ac6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764522921, "uuid": "8752c54a-924b-4098-8c47-9cd038a430c8", "comment": "Malware payload (Mirai)", "value": "d454116ec04c419661724a6a147c1f0cb980cd4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764522921, "uuid": "af0a916b-82f3-49d0-9538-d03d360886d0", "comment": "Malware payload (Mirai)", "value": "3f996819f5ed199c823fc10f921fe5fd859e7fbfc1957ed30d6ed1672fafe1a1eb03cb67d9a81bd2e554cbe598feb681", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764522921, "uuid": "a8831a44-ae82-4b6e-a0f9-65f24c4d85ec", "value": "T1CDD3F846BD418F13C6C722F6FBEE42983B166F6DD7EB320299257FA033464D60936212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764522921, "uuid": "5221ec66-ef81-4524-a3fd-87add1e15c9a", "value": "1536:9L+c98nfJKCs25ON4V98Neb4YQt9+VkYLKbTlulMewywfnYsiXp+6B0sxOJ6vPvw:9LPanfgCsf4osMDt9+qnhEPpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764522921, "uuid": "013b8cce-8f38-481f-85a2-9780bb290caf", "value": 134720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764522921, "uuid": "c9cfc3d5-5ae0-45bc-9939-5761b036a7f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764522921, "uuid": "60c4767a-37bd-4f00-9f00-5f77a8811cd6", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a968c0-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468177, "uuid": "0e31ddf3-0978-43d6-9853-a0d79088f112", "comment": "Malware payload (Mirai)", "value": "f67688bd8a62e92da2624aa878ae4339", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468177, "uuid": "fde8fbd5-4003-43da-a419-b5d950d56363", "comment": "Malware payload (Mirai)", "value": "c3d826404b0e9fbc0382b9b1a871acf72cda3f2f81b5306cd3b9f8741d9d4c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468177, "uuid": "1bf913f7-2466-48a1-bef3-4cabbf43d362", "comment": "Malware payload (Mirai)", "value": "65ded2a896d200c4329152eecc8e4814bfd58ea1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468177, "uuid": "e9b165f3-650d-460f-8748-aba1e7a22891", "comment": "Malware payload (Mirai)", "value": "8676d2c6f96aa108c2308a8a392fc95b3a726cb5fe6fd19e464b0392d2d29510c571cdd80eeb617b6a80c524dd62af29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468177, "uuid": "1726d047-d247-407e-9caf-73997a057d1b", "value": "T1E8D30B45F8814B12D5C111BAFE1E124E37231BB8E2DE73129D246F647B8A9BF0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468177, "uuid": "dc92dce9-2b45-46d6-9d88-906a3657b01c", "value": "3072:6qexN6NdUHZD+iX9EZfdza8VHBZDM5iOuLr:TexNOd40iXiZfZaoA5iOuLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468177, "uuid": "43d8efa6-7163-48b9-880a-8cfe6cd4ce88", "value": 141180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468177, "uuid": "3e4354ac-0ba4-4af4-8819-e11d53827c45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468177, "uuid": "6bce8ada-15e2-4ad8-87a2-93d02490cbce", "value": "odin.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5f6a89-ce16-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764525534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525534, "uuid": "2a87e4fa-5452-488d-8d92-6fec3b38cfd2", "comment": "Malware payload (ConnectWise)", "value": "533452be7f667e4ab8e082289a3663ff", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525534, "uuid": "eec75843-db02-47c5-a4b0-76ba390610f2", "comment": "Malware payload (ConnectWise)", "value": "c5d72bcef0cb31e87ec071a43ad12468cf9a2841a695016e2240b4585f18cba1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525534, "uuid": "bd4b86ad-8485-4d5f-9927-f5ab9d467c01", "comment": "Malware payload (ConnectWise)", "value": "a80ffb5605126f23618b2a21002d96a76800b0f4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764525534, "uuid": "d401a320-638c-4be8-91d7-c23f988db20d", "comment": "Malware payload (ConnectWise)", "value": "0bfca3f8a9beaaaabf1016c80e2ee7e404245964166dd1d5ed2c3e2eb0a1f8061dbeaad769d539527264bfba03be296f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525534, "uuid": "e21a53b1-9546-4d12-9c81-2ed73656f504", "value": "T12B319B2026F98314E3F36F7E68F665529022BD02FDA5CF1D0061824D1861A51EC70F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525534, "uuid": "0d938b3b-4b9f-4444-871e-d6b0b240ca68", "value": "48:8c0m6sTUVNz+X3BIIPTUVNz+phphHrqpDUO:8cNQVNz+X3B4VNz+/fHmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764525534, "uuid": "fa2d1a48-9524-4860-8841-ab3521ec9878", "value": 1631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764525534, "uuid": "9591ef94-da33-412f-95b5-a9c478171444", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764525534, "uuid": "f4331059-28f1-4dcb-9c91-429b7afadffa", "value": "file.exe.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea566e9-ce14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764524974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524974, "uuid": "577ed495-f459-416c-8096-9bb328fac4ee", "comment": "Malware payload (Mirai)", "value": "e7aa6fd0bee1bc40de18596d2c15b1b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524974, "uuid": "021230e3-29b8-4c53-a84d-3fe4579fd75e", "comment": "Malware payload (Mirai)", "value": "c63d8479e20ecb819f4e926d6cce732c9400dbb1767cb37feaf094752a30c245", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524974, "uuid": "6ab8a130-bbe1-4b69-9722-6c8f2528ea12", "comment": "Malware payload (Mirai)", "value": "d0f8e3facf55941eefea7bb4703464a88fbf6353", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524974, "uuid": "4c110a3c-6b0a-4645-84ea-8e578cc16dea", "comment": "Malware payload (Mirai)", "value": "10aa193b3c9687f65f9ec43ce66116d20a95e970e540dc354efcf418007898c97a4988ba2681f1df83656d5417d39721", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524974, "uuid": "b10bc6e6-191c-438d-b88f-fc414b50c834", "value": "T187836C227A755D1BC8C8647A21F74325F2F6A74A24ACCA1A3DB24E8DFF14A4032177F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524974, "uuid": "ac0be58e-ac8a-427b-9ead-24c4948bb36a", "value": "1536:5R2Mx0LNbSs2Uvhx5dTfzpXrK10lD9ketO/N+j54itRfeQchPm:5k+ybJfr6oke4/N24KfeQgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764524974, "uuid": "092598f4-645a-4c52-9c1d-dea5ffad4639", "value": 84476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764524974, "uuid": "22de55db-5085-4f2b-946f-eb8ac0f1eb2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524974, "uuid": "35712338-9dde-4517-92de-22d2897aa70b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7602c46-ce3d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764542598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542598, "uuid": "a6ef584e-7794-4877-aa08-fda067fbee8d", "comment": "Malware payload", "value": "1bdc8adf0a2cc26e246f1583190380c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542598, "uuid": "e863d609-37b1-4b08-9050-9036e97a8b28", "comment": "Malware payload", "value": "c6ba727a0b4200204c182fde2ffabe0f389eab73aba30210ebf37268edacc72f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542598, "uuid": "8be50f81-513a-4483-8899-f88b13fc5573", "comment": "Malware payload", "value": "e5f96f9e418a3bbdbe039431dc9e74f615aa9210", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542598, "uuid": "0b05684b-adb2-46a7-9063-f85ecd04fb29", "comment": "Malware payload", "value": "96e42f2a23392b56dbbb3f933f729624be8b324e9bf6559a37a302bf965f885552085fafcbc71613ac8c3a1f72f448b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542598, "uuid": "37bf97c8-086e-4306-b769-c50b9d76815c", "value": "T105E3FA02A9419F12D5C311B9FF5E415E37136F78E3EE72029D24AFA0778A8EB0D76216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542598, "uuid": "c5f340fc-6437-4dca-bc57-87ed4d7914eb", "value": "3072:GPpE91Q8re9OGXIW2gPlXEe2l5aRMtMKRHTgFOJ3:CO91Q8re9ZN2gXx2Daq3TgFOJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764542598, "uuid": "ba82d7a0-27d7-4ee8-af1c-afc3f6ca90b8", "value": 146964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764542598, "uuid": "12608d43-a0b3-4a74-9298-824ccf8acaf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542598, "uuid": "5395043f-e4b8-4e58-b4f1-9f18199c2cc2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f5d7ea-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540150, "uuid": "407a18d7-6c58-411c-a253-6ca415a9fd8e", "comment": "Malware payload (Mirai)", "value": "e54e793767b66aeb89d7898ff411ccdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540150, "uuid": "55280b2e-7f0c-4e97-a95c-ba191e15b259", "comment": "Malware payload (Mirai)", "value": "cab79e5441b45948219f838d73d2e625c87d99662a8cb7dd0bca586404e04ebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540150, "uuid": "2be0fe3b-39f8-4098-8934-775b1a471237", "comment": "Malware payload (Mirai)", "value": "3643352ce2cbcf6d1d010924f4645e7a1fafe3d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540150, "uuid": "bc444ab7-5a05-4998-9f7d-6260e6cf437f", "comment": "Malware payload (Mirai)", "value": "cef264874d196c4f55e004ddd568a80990f5e32eb4d70da71e27f886f222fba16ef9b39e45fd0decd7d2f206eefd7e2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540150, "uuid": "43be0b3a-3840-493c-9c3e-fb9845b63ca0", "value": "T1F9736A07788690FCC48DC1341AABA531D5ABB9BC1230375537C4FF2E6E4AE112E7DA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540150, "uuid": "d7faf780-b9f8-4f0a-b137-041da9ca2263", "value": "1536:UZUwZI1slu6f9R7DpjpxSuYokFp/sk1/GYC8s6e2NBeRWtFD3k0k4S7FL:udI1swsMGY2kBeID3lm7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540150, "uuid": "5ea4f8d7-b6f3-4db8-ae24-c1fc5e7ef758", "value": 80704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540150, "uuid": "26cd3dc2-f15b-40da-a691-61509ca48ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540150, "uuid": "3b5e54db-7be8-416b-b430-a707cb06c897", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1f12f3-cd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764467441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467441, "uuid": "9d173e41-d248-4f84-b3c7-244adefcf043", "comment": "Malware payload (njrat)", "value": "b9feab657ee7505549a8eddef8bb99ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467441, "uuid": "1be7d847-6ecc-4d11-8f19-cb80147d89df", "comment": "Malware payload (njrat)", "value": "cbce96ade4bc2744d9dbb0dae6f2ecc2766e0386a0cfe6ca0a33d0c767119912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467441, "uuid": "12f28fdf-2fff-451f-a7aa-566c5eb23554", "comment": "Malware payload (njrat)", "value": "2af4ab2822e1bbde4bd890d2b84a877a5a0ac051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467441, "uuid": "400ee84e-a1bf-4082-b127-a8f584bea7c5", "comment": "Malware payload (njrat)", "value": "6c01dc6045bb8309d6f3161fd6a8e5b67bb3c5ff91a8ff1e1aceb638e6816a627ca2ca4e6abbe130e885074152ab560a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467441, "uuid": "7693adf6-fe39-44dd-9f80-8e3905496fce", "value": "T16545149C766072DFC85BD472DEA81C64EB6074BB931F5203A02716EDAA4D997CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467441, "uuid": "bfc8fe3d-7e3f-4cda-9fcc-4cfc8f2c45a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467441, "uuid": "6a6c6a78-7ae9-4a42-9c45-1c4dc3b90ec7", "value": "12288:BQu7Y+2W2RlotrtCSDiHTWiD3ZeuLPeF8iBqfVc6fQlOQAxnawaqhU4ypqURH8gg:BQu7Y+t2eLwDIuLPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764467441, "uuid": "520815bf-e5da-4a3d-af94-105aeb5f7e57", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764467441, "uuid": "f6cc2553-8f2b-4ffa-98f8-25c3041e5be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467441, "uuid": "9e47b060-bde3-48ff-a959-df44134f9654", "value": "FinalMom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b140fe5-ce41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544161, "uuid": "2b09af54-035d-40a7-a1c3-82520064bce3", "comment": "Malware payload (Mirai)", "value": "919e40bd15b2af940319da207bd253b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544161, "uuid": "2db2bd37-a182-47d2-9310-6f044c2dd187", "comment": "Malware payload (Mirai)", "value": "cc18500b006f69821db089da2680328eaa3f0d35367a26df30fb19394418f171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544161, "uuid": "dcce8f8f-ca70-4847-b1f5-c171af40ddf8", "comment": "Malware payload (Mirai)", "value": "ec7d3599f5139dda06ba33425d4dafc1fd69a67a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544161, "uuid": "7ece6d00-fb42-4f35-bedd-1ab0b98407cb", "comment": "Malware payload (Mirai)", "value": "7ecf2a8718f3c13316d43d1e65e6ba704bbc7c588a44cf59710cf01af0e66e0618667870b92a95f213655fbb4ed36fd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544161, "uuid": "8ff35599-7bb6-421a-a2ed-84256924a2ba", "value": "T174B34B03B9C29CFDC046C034477FB936D925F0EE2638B29B67F5AE266D0EE600B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544161, "uuid": "7f0540d9-4cfa-415a-8272-17e168e02834", "value": "3072:emvsrP1O2m3v9yg62bUQ5udGcLlumTThDygfEKEpMC:emvsgv9yg62bUQs4YTpfZWMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544161, "uuid": "028bbae4-6552-492d-9498-0ffc2a507f7e", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544161, "uuid": "ad958178-f8da-4a51-9503-aa67d38cb3c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544161, "uuid": "875c5b45-6d35-4fc1-812e-cd6748e9a270", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b710ff-cdd8-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764499208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499208, "uuid": "45803a41-aa95-4df6-ae79-1c0ff7e01c5d", "comment": "Malware payload (NetSupport)", "value": "031434d647d632982e61856c20b850a8", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499208, "uuid": "4322ffeb-3354-4f85-874d-19970f4f577e", "comment": "Malware payload (NetSupport)", "value": "ce033842cfe62ccfa6e1952acde5089722e171662e27717ed4d873fb3e8080a3", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499208, "uuid": "3819668d-fd60-43be-a8f3-e13b1b5d2861", "comment": "Malware payload (NetSupport)", "value": "46a99c71d8d15c2367cf434b4d6a16c4f50fa89e", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499208, "uuid": "45c8da07-005a-4c10-a094-c502af8f1e3d", "comment": "Malware payload (NetSupport)", "value": "26006ffdd13d960a78c0af401134d9ceb3299a2906d2f78c8fc2423754a08758824c429cf06a30e10703578ac564581c", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499208, "uuid": "aa562281-3631-47aa-ac17-e6febb3fc95b", "value": "T15E768DB284476C37BE4D394680062FA29FB8165B37188A41DB147BB9B1DCC55FF7C8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499208, "uuid": "adf574e3-4005-4ffc-9bf8-65aa04231f03", "value": "49152:Vs4+bPuCU1B2/I5DpEPMyGnytAT9zSBwSr7/dvyvXvnfDqKf8LuR6ZbP+8oOvn2O:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764499208, "uuid": "24d32ddc-4433-4e73-96b8-11c898a3622a", "value": 7362995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764499208, "uuid": "2899735f-9564-41e8-90c4-d9fa09df84c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499208, "uuid": "dd3f896a-9018-4321-97e2-679f1ce7d3d2", "value": "30112025102226111.mp3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea719c26-cdaf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764481588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481588, "uuid": "50a1c80d-9aa6-49fe-b186-d3a4ecfbcd60", "comment": "Malware payload", "value": "93249c558cbd0fb5f750ad14470f5d1c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481588, "uuid": "455a2d55-3305-4290-9457-4e9083391021", "comment": "Malware payload", "value": "ce7c6f882a0d99b74ba757e9f0634a2fb39cc9bb139d6aafb57ad9572c2de087", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481588, "uuid": "60eae70c-96ab-4678-9256-43a2888721c3", "comment": "Malware payload", "value": "e6b96e0b9dcbd69972aeff8589917ffe4fbdc13d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764481588, "uuid": "ce203b82-454e-4619-b9b4-faf7b3ba6225", "comment": "Malware payload", "value": "a6a84a5f1f8b2264a0060af2d5f2b0c7125ef50439067b8fe56f3233b93aa8446a8414aa5c878ff378a590efbc83e1d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481588, "uuid": "b48dee34-66d0-41fa-b8d1-1270d10f378c", "value": "T1ED848E1EFB6414F9E1E7C178CE534906EB727C8947B0A69F23E44A961F232A09D3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481588, "uuid": "d405840b-8109-4ee8-907f-7b799addc8a5", "value": "ac44f01609d5947cdb02277d63cfa5b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481588, "uuid": "501fbfec-92d7-4b94-8f2c-79a8e67d30df", "value": "6144:mU4l/yrpTSurkD5Zvs3/XO/WhG40Q/O4:+49eurp3fO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764481588, "uuid": "d48b271a-a16c-4fea-b472-643faa24a68e", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764481588, "uuid": "7a7ac578-b8ff-4bed-b96c-836b3a00549b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764481588, "uuid": "02b54fe9-ee57-4f8e-9513-dab750aa1511", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5c7d9b-cdac-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764480006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764480006, "uuid": "41acecd1-c7b1-4ab6-a7d6-46e0d540e023", "comment": "Malware payload (Loki)", "value": "63fa1bab048451712fb3badb7a48c059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764480006, "uuid": "c896d6a4-07d8-4048-9b13-08efb1a1c624", "comment": "Malware payload (Loki)", "value": "ceac7b2b2eef92d7c2a7888e7b580903753d904ffa82849f05574faea26b773c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764480006, "uuid": "3a238d30-a741-4808-b126-7b372b0f4ff1", "comment": "Malware payload (Loki)", "value": "7d232a44ac0b14e282df9214eecab3cae9547f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764480006, "uuid": "7e4861cc-fe78-464f-8dea-e51c7cfccd50", "comment": "Malware payload (Loki)", "value": "5e4e5731ff0676b8f13d7220916b2820f86f540fd13ff370155e04205998dc1eeca8162c4d9ff7dd3a76b25fac833a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764480006, "uuid": "5e1fcfc0-dbe7-4f90-b246-4af07434580f", "value": "T19044AE8D36A0B5EFC867C472CEA51C64EA60B87B531BD603A01B16ED9A0E597CF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764480006, "uuid": "659f0348-df3d-414a-b7f3-e5c0e5de1c5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764480006, "uuid": "35a66ef6-fedd-4947-ba76-5f821a7f817b", "value": "6144:Uk1UciX/RPyFEfdOvlfcl59xGeqOhai9V3Im1HEGgvTREaqzEhGmaX2X5JI:v3iXJBPr/QgV3ImXgTOacEhGmaX2X5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764480006, "uuid": "abf9cb06-b298-489b-a55b-d95be6f83ea9", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764480006, "uuid": "fcaec6c9-851a-4211-8958-fc0a298d1d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764480006, "uuid": "6c69c95a-1515-4273-bb81-2f1a89105d1c", "value": "ceac7b2b2eef92d7c2a7888e7b580903753d904ffa828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500de62e-cdcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764494214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494214, "uuid": "eb4cbf5a-7ab4-4bde-b850-e4c46987797a", "comment": "Malware payload (Mirai)", "value": "38b226ad1e8bbbecba81dd9c24c5dc3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494214, "uuid": "6a154fba-6769-4396-a0c9-6f6279f6f898", "comment": "Malware payload (Mirai)", "value": "d00ec7eefd46382b8baa4949ade387a6ac5d78f6c1d815bc5a9b17b5398a5a28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494214, "uuid": "3f7e29a4-de6d-4f00-bcce-ab4ce5c9b3db", "comment": "Malware payload (Mirai)", "value": "95cca07843a25f10873c624ca50c4cbb929a3640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764494214, "uuid": "47bcaf0c-3276-476d-b76b-09b5b37c57a1", "comment": "Malware payload (Mirai)", "value": "d2afe2ade921d20ac61935162119fb47e6c349640d51db139587a94a6aee2a65e2bb81c18317b69d865d2482aa8ca18f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494214, "uuid": "3faf63fd-47eb-4f1f-b728-f5bdb4615e93", "value": "T10AE39FB3F30B1091C82306F417CB6B9C2E2315425F6B86D3BCAA313A2A765DE5915BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494214, "uuid": "12e86210-cd06-4cc5-8952-02e9a087abd3", "value": "3072:X/1HeTDitCaG9y+y0+Xk+cdLfSFztgQg5CvugQt5SPub01yOq:P0mGvy/aKFztgjCvattOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764494214, "uuid": "7a416aea-14dc-4ea9-a9ee-03159d61fdd4", "value": 157136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764494214, "uuid": "2193ea58-def2-4dfb-985d-77d4fa11342f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764494214, "uuid": "0097b519-0654-404c-9d7f-77ead9f49891", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6754bff6-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540209, "uuid": "c6ba2a4a-169c-4269-8bdb-74c4f7f5be60", "comment": "Malware payload (Mirai)", "value": "bfbe3c736bc7f477fb4e1c7430dbc94f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540209, "uuid": "c6801657-fabf-47b7-8167-5355415171ba", "comment": "Malware payload (Mirai)", "value": "d163373e71293cdb61fbe3249098113decaf0d0cdda2c1857a0beea03f965bd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540209, "uuid": "f667e677-08bc-425a-8387-76285cacb8ce", "comment": "Malware payload (Mirai)", "value": "85ea8102ad63648cc89cbf6a44aad691664fe9b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540209, "uuid": "7770ec6c-b259-47f1-8e24-21c8a2d74e29", "comment": "Malware payload (Mirai)", "value": "c43ff0a2a77682d30dc2ac59297ad41f8ef8f4cfa76e7880f094b26541046607d1f4d8f03287a29a9eb5eb9368fcfea0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540209, "uuid": "7b067d21-a538-40be-87c7-a45db64587de", "value": "T1E6230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540209, "uuid": "bba9c1c1-2e84-4a49-98f0-e379d760bb01", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THl:5DmKF7Gxyk8cqoHAmWurAufsG5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540209, "uuid": "bb5cd4e0-19a0-4cd4-a44b-b4d7d43beb6e", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540209, "uuid": "c93353dc-be33-43cc-b257-94b4fae3fcf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540209, "uuid": "c25ed924-cfb7-45b8-a229-756c8dd49f7b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833daef0-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496877, "uuid": "eb21e5ce-0b71-442a-8215-b201a02da711", "comment": "Malware payload (Mirai)", "value": "5ccb4dd500611a8999b9de34a08d8d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496877, "uuid": "48b3d00c-3cc1-48b7-9881-9d6c5d975328", "comment": "Malware payload (Mirai)", "value": "d1fcb271056351d18dc494bad0092c934a5a43f4251405652ebc56fb813acef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496877, "uuid": "29cbd32b-3900-400f-bc8e-6ba87e986753", "comment": "Malware payload (Mirai)", "value": "0000280d22c73d152d6f5b98658865a8e10ba13a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496877, "uuid": "7e435729-a891-4c06-8eb4-6dd7c37b88b8", "comment": "Malware payload (Mirai)", "value": "d613cdf806d3bc83cd261993d49dd348caed6eddf33e0363c201dbfded474686ca4f393bf792cf0862f733dc72654b5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496877, "uuid": "2fef42a8-71a6-4b1a-bbd9-b02949f77740", "value": "T16C530885BC918A17C6D462BBFA6E41CD332613A8D2DF7203DD116F157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496877, "uuid": "25f4881f-25db-4457-ab41-9c17c0657c50", "value": "768:xnT1W0CRqlxmyakvnHeAchG/NLqjycrujuHY0q3hMLk8aIY1NG7BXGPl05Mh38zj:x1RCqnHMhGtwycrumpK67MPa6itug7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496877, "uuid": "4ea8651f-fa16-4f43-b822-ddf0d7f67990", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496877, "uuid": "f854c875-d22e-45b2-9637-3262c0934a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496877, "uuid": "d1717742-559f-4875-9149-92f466eef890", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58397b6-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490626, "uuid": "0cd920f9-f46c-4fdd-8fa0-78ec21502199", "comment": "Malware payload", "value": "6c1b80ceeb9d18cb59dcfb5439371c56", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490626, "uuid": "f43d9ab6-299d-4e01-9ca4-4ea532155257", "comment": "Malware payload", "value": "d1fec0ce2be2097357d307e835783380ac010c7d55f3e72fa3906f0d0edd7a6a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490626, "uuid": "2408e2e7-9858-4eaf-940d-391e098acb23", "comment": "Malware payload", "value": "ddee2ba2045d473ba6c21d157887d81c687053e3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490626, "uuid": "146c5d7b-febd-4183-bdb5-ddd9fe561ef2", "comment": "Malware payload", "value": "f8037aef43e2a1c7ff01969c809d33d811431c3f972f6078d53456161b17713bb9cd5334f2c4633fa0c7175171254ed8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490626, "uuid": "ce3da866-3cda-4d18-b4f2-a09c52727e01", "value": "T10B66E1C2BFC59289C6B65A3E0571916513629F3707A38AD73ED8F7344E333A05A86F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490626, "uuid": "b01ee86a-cb1a-4fc2-a2ef-cdf965ed0c3f", "value": "196608:cWt1VXz0ZBxrIvTntwT7bhDB5BKDGUyxJoQ7Nu:cWJj2Bx0TtwLLDgiGQ70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490626, "uuid": "f8dd13ee-af91-4fd0-9808-3d1707254f01", "value": 6628636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490626, "uuid": "3c63d88e-5cf4-4314-861a-b403f077644c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490626, "uuid": "2bf273ec-ef77-498e-bf32-7caba3bab352", "value": "e-ChallanV3.9.21.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35926d50-cda3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764476131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476131, "uuid": "5e2883ca-b742-4890-9d79-94fa6a51dede", "comment": "Malware payload (Mirai)", "value": "00444d3795a32f57df543bb7b7e83906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476131, "uuid": "a0e2624e-3611-4549-ae55-ddf5f57d547e", "comment": "Malware payload (Mirai)", "value": "d2942d3b9b2e2dc98a34dc5a0d35c0ff7cb5ab419dfba7b1fca32fb6927732c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476131, "uuid": "398b17fe-36e4-4c5e-bea1-5266a1533a68", "comment": "Malware payload (Mirai)", "value": "63e1196cf41fb7c9c6c54097ad6efb5de5a0ad1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476131, "uuid": "0cf2b8b0-54b2-459d-99d9-b7317e225102", "comment": "Malware payload (Mirai)", "value": "fd533aa65dfdcb1bc5e34f3cabb65e60a251ad343b7018dbb6f18a287d5acfe24d2fae29e66c52456d49c9183d1c057a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476131, "uuid": "a55efd58-e1bd-4b9f-b563-4cea7b4faecd", "value": "T15BD329C0F643D1FAE50907B15136AB338632FD35602EE697CBA8EF367871A90C65925C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476131, "uuid": "3a4edf3f-b105-4ee6-a666-c70b8208663a", "value": "3072:C0j2HmQy4Zu2t4K6TY9CL0TII5POZT+wc54ewFu1Tg4LFsvbv1awjHbBY42h13vu:LAmQy4Zu2t4K6TY960TII52d+wc54ewi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764476131, "uuid": "51a273c0-49d1-4922-97a9-182ec567d03d", "value": 133068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764476131, "uuid": "7d931e11-aba6-434e-806b-11a311f75ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476131, "uuid": "53e1834d-a7dd-4438-9f31-9a4c0ac7978c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4feeeea1-ce3f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764543176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543176, "uuid": "e1289ad4-866f-488a-b9d1-5aab0bf933bd", "comment": "Malware payload", "value": "30deba15f2593f9f7875e0204bb0ee0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543176, "uuid": "2a4feadb-e3f3-441e-82bb-f64c826dd88c", "comment": "Malware payload", "value": "d32886152e57ba0dda0900af36b3babb7063c4ea34f4b4ae58344ba45bc933b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543176, "uuid": "472beb82-f9f3-4544-a288-597794c8dcf7", "comment": "Malware payload", "value": "d088418cc2e3bcdff3baaa1091a7a7575e1d7f1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543176, "uuid": "a5611a19-4f83-4c5c-82c7-a0014592c2ae", "comment": "Malware payload", "value": "2c50e5eb7c87b97b69c8e2d11e71a1435d889a103243ebc599a439ea02e018b280f096e0c0c5383280eaa4730b8a2371", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543176, "uuid": "fdb1b44f-1453-4b26-957d-3c02ce2383da", "value": "T1B573D90A2E219FADF76CC73647B78F309798339626E1C545E56CEA015E6030DA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543176, "uuid": "7eefe98f-1cf7-4b52-904c-94cb576db9f9", "value": "1536:wSJfSc2Zz4tNgSYQ/o8Qwbb0aBvNIq+HgDHNpDHHCpxQZPeth+0uvx:wsS5ZjPiBvNIr1t00up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543176, "uuid": "2478eb6c-2dfd-460c-b364-891b5feeed8b", "value": 75824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543176, "uuid": "73863405-3d48-42d6-b963-d6aff9e25901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543176, "uuid": "c1f67573-d6c2-424a-b7b4-0aaf6bdee1fe", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ace9076-ce41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544134, "uuid": "35bcfc32-2d98-4a8d-be38-a4029e792a86", "comment": "Malware payload (Mirai)", "value": "673eb1a736c7991963cd8d4a404c7dcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544134, "uuid": "5c5d0542-facb-4fcc-aad9-c46b37cbf156", "comment": "Malware payload (Mirai)", "value": "d3cf20462308c14ecdae9a05a63526cf586de84f919e6b6a380834d98afdc17e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544134, "uuid": "8a716928-53cf-4715-aedb-c980b1daa10e", "comment": "Malware payload (Mirai)", "value": "2866cf22dd8df75046b014ec5f6d68e5813d043e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544134, "uuid": "3d81f993-c01a-4cc5-96d7-e2e123287815", "comment": "Malware payload (Mirai)", "value": "b90c399ef0e18821f8d247c99199819c8582c1defd205ece1288104bae64a98581cb90057c548b10e56b3ab46d6f9304", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544134, "uuid": "6a749e75-bf60-40e2-bb88-3fe4858c885a", "value": "T1A423F24B9219CAB8E0E21AB76919A5CCEFF13C5B905E5937214D353E081DA6F3032E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544134, "uuid": "cca7ea64-0278-405e-bf55-f1bbc1d82ca2", "value": "768:ttB548w628WWpbLcWgmxNEmS8DACvBdPB0xSST5/D/bYyJejnCDTVbxD7OlvtclK:PBw62YcWhNEmSYAC56SQ3EjGxxD7Ohth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544134, "uuid": "6063e28c-37d4-49af-97fd-4b1fcc498f44", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544134, "uuid": "5ae8e726-b3e8-4d26-9ca6-076891c6a7f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544134, "uuid": "3b537cfa-8edf-4f8b-8641-d541db8ebf40", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447770b6-cdc3-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764489899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489899, "uuid": "02a0cd4d-7f82-41b8-a1ce-f2e245e82144", "comment": "Malware payload (ACRStealer)", "value": "a9fd2d245f51800d4d5d04c96dfd873c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489899, "uuid": "6571164a-d9cd-4d78-819d-7de3f0e81ef2", "comment": "Malware payload (ACRStealer)", "value": "d3d7ecac0f6c34455ce48dfadc2a1c31d75b5118a1defad02d2666789374c052", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489899, "uuid": "34081817-7100-448c-9428-e52013819d3b", "comment": "Malware payload (ACRStealer)", "value": "2ec32e876efe556bd6ceb35d7d86471ff8ecae97", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489899, "uuid": "23adee56-347f-47b7-b90c-ca62e8e4524d", "comment": "Malware payload (ACRStealer)", "value": "aa65ee80ed1b88c365011542585205cf56f525d2940b6072f7553c341ddebfe978abdc2c8e6fa2fcea43ccb329ea1cbf", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489899, "uuid": "37d82642-ef69-48a2-8b59-3922a0a8bb6a", "value": "T1FA2522285BE91066D9B667B498F200A7CA72B4716B3196FF10D4C17E1F639C0E936F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489899, "uuid": "1cf2534c-05d5-4efd-bbff-f59308afff71", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489899, "uuid": "3a199f84-1e43-49c6-939f-c36e9b90069b", "value": "24576:iuPgEZ5cJ0Tyuw9QdtzuCf4k6PgDdZ59HFIyP:KMcyTyREzRDdr9HFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764489899, "uuid": "32bf510a-139d-429b-a1ac-2cc1302cac6f", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764489899, "uuid": "f6b618b0-2468-4cac-a603-2eb30e32f3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489899, "uuid": "588d27f6-549a-473a-ada2-e4628c5f8747", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd47f94-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468199, "uuid": "3a735343-3d84-4f7a-b041-9510bacf3f7d", "comment": "Malware payload", "value": "6ba1312af0841608d7dadd7e22bea1e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468199, "uuid": "bdfa11ee-6b71-41f5-9013-de03edbfa647", "comment": "Malware payload", "value": "d5084342fb3caaad185e65e1665b69f5f4436caf22e9a7bce275479827e7f9c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468199, "uuid": "1ad0377c-4e24-40d7-a46b-956ff7334d2f", "comment": "Malware payload", "value": "a85002dd610b9982add321875aa91af8cba04da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468199, "uuid": "3cd92806-3bc1-47c6-aea8-b5083c5ceddf", "comment": "Malware payload", "value": "3494f02ad169e7e8d18ef4a916f77ed539d8e554b23d93b21f79d3c676b9a199a61f0aa63b87ea73a790105063ddb311", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468199, "uuid": "a881de7c-8828-44ef-ac41-dfde78c0a376", "value": "T14275337A221349FAAD306F76389DDC50DBEA023A357836C6C84478E0F67F9AAD7145C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468199, "uuid": "3c318f44-4c2a-4623-a6ea-26bbfcafa77b", "value": "49152:FNfel2wifAGbiHGdCeDJnzenYFPkFeQ8h:7ml2lfAJGdDpenYFoeJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468199, "uuid": "d5b32901-e615-4851-95e4-15b693ea1341", "value": 1623604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468199, "uuid": "27015bc2-b94d-4d4f-9792-69bfcb746815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468199, "uuid": "5c6e48ec-e901-4e47-b051-594269b8845d", "value": "bizy.mpsls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8442d104-cdeb-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764507186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507186, "uuid": "c471afab-9129-47ad-9699-7b8098e6ca9b", "comment": "Malware payload (RedLineStealer)", "value": "258b448a0d5bb2eb03216808c1de72be", "object_relation": "md5", "Tag": [ { "name": "5-175-234-103", "colour": "#25F498", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507186, "uuid": "1f1c6449-c576-499d-92db-3bc5da3db061", "comment": "Malware payload (RedLineStealer)", "value": "d60948bec342f2704c2b88470614d6c679ad8626a741db0be6ee0a75efab7217", "object_relation": "sha256", "Tag": [ { "name": "5-175-234-103", "colour": "#25F498", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507186, "uuid": "a9111736-d99a-4ac5-b553-bbbc36718330", "comment": "Malware payload (RedLineStealer)", "value": "308b7eb26a5371aa83e7d66055cd9cd4f0a67817", "object_relation": "sha1", "Tag": [ { "name": "5-175-234-103", "colour": "#25F498", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764507186, "uuid": "c5ecd3ea-5c54-440f-b6d0-ebe98ad124e2", "comment": "Malware payload (RedLineStealer)", "value": "0301debe027cf9298e069f85e1f43218440f039945e4ac30df3570c387d776b3926959bfeaa8a6664e5ebcbe954e8e8b", "object_relation": "sha3-384", "Tag": [ { "name": "5-175-234-103", "colour": "#25F498", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507186, "uuid": "74e79238-ea01-463c-92f6-fe9cb1254172", "value": "T134A35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507186, "uuid": "d3f35f62-4339-4e55-9742-4ff9cc83787c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507186, "uuid": "f624e1d2-b304-491d-a3c8-c7a315788580", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2F3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764507186, "uuid": "ece0f31b-1cdf-44cf-a637-d503bfb90cbe", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764507186, "uuid": "f20d32e4-8db7-4aeb-8574-f7b5833dac74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764507186, "uuid": "f0e980fe-cb16-4104-866b-71ecb418a46d", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b621fd3-ce35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764538793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538793, "uuid": "836f6e26-b78f-4f20-a500-45743aa74de5", "comment": "Malware payload (Mirai)", "value": "543acda1c25b788caf22b1b9caa52e57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538793, "uuid": "b65933d3-05f3-4547-8b76-3957b9b7688f", "comment": "Malware payload (Mirai)", "value": "d65fe6b8e6c79a61e36ecde5659d45a1f0a0ac126a528524c7e6f45cfc8a4ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538793, "uuid": "d28ed24c-0a17-4c70-b7a1-b724ab2b9d9b", "comment": "Malware payload (Mirai)", "value": "f77e38fcf8a374bece5d5f7fec6b8eb3caf51b6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764538793, "uuid": "fbdaf307-f116-44de-987f-7481b3ff6318", "comment": "Malware payload (Mirai)", "value": "f259194981c2c175a58490266c6c90e6ee3c1a968693cbcb99e821bfdefcb0df17b0adb6566006a6d99395a36361b819", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538793, "uuid": "71f5068c-3de8-4f92-be11-067322b7e41a", "value": "T1CA93E551BC82562BC5E423BAB6BE668D336577E5C2CF722BC8214B117B8551F0C63F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538793, "uuid": "37c85c58-5335-4f30-8653-73311b8d12bb", "value": "1536:hd+brYvZIQFj/sV0B4oA4MLuHtwuO/hYqZCt2bYQm0O7mcT:n+bGZIPV/PugbYQmp/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764538793, "uuid": "a69b61d7-0600-4238-b05c-a9c49f3c01fc", "value": 93800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764538793, "uuid": "77bc11b2-e710-4bc9-818c-f61fe33bdbfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764538793, "uuid": "0f478938-a5e0-4282-8551-c8b53a9328a4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e313cd1d-ce25-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764532256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532256, "uuid": "455f6f5c-7d0d-4267-9ac7-b91445209f75", "comment": "Malware payload", "value": "477e1a7313e9879c9ee47afb1ea0ab5b", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532256, "uuid": "34426269-2213-442d-8c3f-d1034b46c4f5", "comment": "Malware payload", "value": "d6c85dd6e480129ce87a408ea8cd0dfaf7c56573e306a5f0a37cc9541b8f6f04", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532256, "uuid": "db764a4f-d0ac-4f40-90b6-4ded0d8bf0de", "comment": "Malware payload", "value": "ffecbf7362e092fd3ccb7077c62497dbc4502b86", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532256, "uuid": "4a3d15df-c5d0-4015-827a-5cd2a7427ee0", "comment": "Malware payload", "value": "7de227f9b6f80f39864b8704167415b4b7cadb93dfd3f79904a586c9e843569cc4a902e888aa3576466c95ef78ceaef8", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532256, "uuid": "07f7e749-3491-468a-a8d6-657ad4174af7", "value": "T164062319E7F408F9D4A7E4789A565A42E3BB7C494332D78F07E416521F232E08E3EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532256, "uuid": "cafdd552-a3e9-4b81-85be-9c29ca2ddf1c", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532256, "uuid": "47aaca9a-c9b5-48df-99a7-42294bfab7eb", "value": "98304:Jz/iy1z02EeTsHdFTn7RgV+I41vX90A2j:Jz/icvVgXD7RgV3yN0Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532256, "uuid": "5ca716b2-7cb6-400b-b620-c8fb27d68fcb", "value": 3940357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532256, "uuid": "fb8af629-b8c8-4885-8e04-d43dd5633c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532256, "uuid": "4d99ade8-9b27-49e2-8708-d1b6864e782a", "value": "\u7231\u60c5\u7684\u6101\u76f8\u601d\u7684\u9152-_\u6613\u6b23++\u70ed\u641c\u7f51music_mp3.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4c8909-ce21-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764530552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530552, "uuid": "657e8ae4-edec-4422-af98-a0259ca236da", "comment": "Malware payload", "value": "28f026633bca2f58f40ad8660925f7d1", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530552, "uuid": "28a9d607-52b4-4031-9fc0-0761fd06fbe1", "comment": "Malware payload", "value": "d8282ae9485c170bc5728e80cd77882b7b5b6023c99a4e59e7e611a78a17ba74", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530552, "uuid": "7a947d71-6352-4f3d-afd4-b44d414b2587", "comment": "Malware payload", "value": "5e2f6d59e0179a4870ef0791feaabb7880d79034", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530552, "uuid": "07d87ae4-2d05-4391-b5b7-950b8832b224", "comment": "Malware payload", "value": "5837cb78bf1ff25224ecfd748dd54e704377b86f9446221e12350a4b25371f44ee8b656f6308387f70b369002cf90784", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530552, "uuid": "49a70cb3-b881-4611-8791-b2e941e61778", "value": "T1DAD6332586408236D54D8BF77EF07EB23FBFA9D641C8B91AC3E744A5C9D8F413268462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530552, "uuid": "d05b876d-1933-47f9-be02-9dbdb943c9bb", "value": "5e48fbae3520a62c95e412b293e1759c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530552, "uuid": "77c08cf1-286a-47ed-aeae-3b76597b7622", "value": "393216:Ens4oupdQoRdNUs20ROy/YHGeUVR5u7Uo8ufe:gstAdbHZ20t/YILo98um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530552, "uuid": "06568385-d0a0-4a1e-b2be-49a4ceca5807", "value": 13580361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530552, "uuid": "12007a5e-f159-40c5-8e82-b39930a6b02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530552, "uuid": "bd20075c-151c-485b-8cf3-c9b7f0657e5a", "value": "ChroneSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0672d9a2-cda2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475622, "uuid": "8ededa67-d257-4f7b-910f-96e52581ced3", "comment": "Malware payload (Mirai)", "value": "69111b73952555c8cca1ee9e897946d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475622, "uuid": "e5556ad3-0063-4340-992d-6f40f34586b9", "comment": "Malware payload (Mirai)", "value": "d8586f742f019f10344183fc527a27453d30d0c977481b76d888c847049eda1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475622, "uuid": "b51b2786-d658-4d78-a588-ab5fa45112e7", "comment": "Malware payload (Mirai)", "value": "8f340a2b604e02a61a82b2f9662b7c574548e6d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475622, "uuid": "601f824f-0086-40a0-ba0e-380bb64081ee", "comment": "Malware payload (Mirai)", "value": "bb500de7d34345b2a7224a49dd4287a2d70e9cb81bb2d33925a9667aaaec6fd810400a4ef1d8bf34dc2090e70141ba06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475622, "uuid": "31097a6f-bc5a-4567-9b3e-925ebf291624", "value": "T1284302987108A2D1C2BB1DF0D4690BAA1A5BE7A9DCCDD86F681406192FC385B3C7D17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475622, "uuid": "50f775be-a9ff-4157-83f3-dcb98e413e52", "value": "1536:a+jmhazpakm1j6ioFZUIfpqSG/2zQN7ZJ3ngiXDzk:qhWpGj6i/IfpEe+n3gkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475622, "uuid": "fb853348-05ec-49fe-bde4-7dd626c9e233", "value": 59160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475622, "uuid": "1d093f91-ff7b-483e-b857-8008a20f279d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475622, "uuid": "8e5cf736-49ee-4349-8f41-9e339b90fc25", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d88e4c-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490606, "uuid": "6d772a86-1b3c-4825-8726-624d9e6e6e7c", "comment": "Malware payload", "value": "cafaec47d8ae7c8ee11dd27a1e01610b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490606, "uuid": "5d6aec0b-0761-4d16-944f-e174054ba1f0", "comment": "Malware payload", "value": "d8a736b8f6dcf3fe4f63dd5cfb1a05f587b1073f7e085f86e3cc4065a4c5babe", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490606, "uuid": "4287924f-6d3c-4410-89ab-b14cde4b5203", "comment": "Malware payload", "value": "d2aeb72c9914779260fed3e7cbbf2c72b6d98f91", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490606, "uuid": "72301264-810a-4929-9a6d-adbdb1c9e67b", "comment": "Malware payload", "value": "661c9da02c2dd6d326e53de03dac2f33467fb7be461f52ed47ea3ff0891f397db822a0fa34a6e44ac060d874aa49095c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490606, "uuid": "8a6a7ef3-2975-4e20-b41a-c4e58a27fc85", "value": "T15EA612C6F7D8942FC8375132C9BA12F151974C528A82EF436958721C2DBB6E81F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490606, "uuid": "4f674544-6945-4146-9cd6-bbbeaacf10ae", "value": "196608:lSzTMojrTLA+75q7J4IdSKQEAASodZIgGH+zqoh8j7GIakl:szTMgTDw7JThRGH+Rh8j7Fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490606, "uuid": "2a28d3ce-c72b-45ac-ad15-f57e5099ce67", "value": 10057117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490606, "uuid": "4b93ac18-d15c-4e8f-9cef-29cfca70dea6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490606, "uuid": "5cbe4841-dea8-48db-a592-64d150bb7c69", "value": "TARA567.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87871e6-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468190, "uuid": "7ffb98d4-5d3e-4e1a-8732-df71bfe99f72", "comment": "Malware payload", "value": "71733b205c0f2333c118c991ab35e0b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468190, "uuid": "9a2d101c-6268-40bb-9d35-712d7a3ffe52", "comment": "Malware payload", "value": "da3e18e3ef495fb7983a2357550d64833b22ab3c4d93d17ac62b7a5d76adee86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468190, "uuid": "ea8cce9f-b063-4f38-b5c0-49acf274c942", "comment": "Malware payload", "value": "b4ece82bcae79cf0996b12f4a28a663481d4cf35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468190, "uuid": "62ba8f76-6247-46c4-8c47-635d5c8dfe11", "comment": "Malware payload", "value": "64b06e668516865339acb88d2b15ab4647fcc3ef4dddd414c311c8409695dc561302d1196621bd5972ef8151abdf0611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468190, "uuid": "5b5823e9-d8f4-4095-bcfd-83f3153f9d3e", "value": "T1067533F0F2E413EE6C98ABB5AFCDC3A8F0E995251870A07F5D9F055A44732A753241AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468190, "uuid": "7634fa20-702a-43e3-b334-0ea4b239bfc0", "value": "24576:lHOxweZC65l4+td1KSWsLf4eF/OOpquclBb/Wlg48uKORCKfqJypGF3YrXj+9+Ql:4xNdt77WGQmAv4+sfEypG5Ym8Q/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468190, "uuid": "1af1311e-e1f4-4d49-8ec7-5f5ff683cb91", "value": 1645884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468190, "uuid": "0a0f01b0-d4fb-43a9-b83e-1a0dca010be9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468190, "uuid": "45b180f7-fe8b-4e90-a7b5-cf68ae428bb8", "value": "bizy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fac248e-ce46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764546075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546075, "uuid": "9cd5aeb6-0b7d-41d8-a55c-9428d3128169", "comment": "Malware payload (Mirai)", "value": "cec24e391f59f560640b132bc6003481", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546075, "uuid": "81178b09-f94b-4f5a-beab-4522325e6a8f", "comment": "Malware payload (Mirai)", "value": "db38dab8aa5d944fb7a5c7d1db712c2981a654e144a4f864782721690e3512d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546075, "uuid": "db603229-d392-4148-b153-7278aeca2293", "comment": "Malware payload (Mirai)", "value": "2357bd72ffed5bb49b7ddf31afd873c066a898a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764546075, "uuid": "7bd07617-983d-4471-9a2d-42bf4d319611", "comment": "Malware payload (Mirai)", "value": "3dca9e8c7db98f5760a8463fa6fbc7f3c383a25c27379581184bdcc73a59bfe9d2fb376160b9cf9a849d5ab53deff8ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546075, "uuid": "bf2349fc-fb46-4a74-a4c9-2355927b0f8d", "value": "T17BB33A51F8C29A62C6C7237AFAAE41CE332227E4D3DE7117CE256F21378251B0E67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546075, "uuid": "e88fbed7-07f1-40ee-a798-92947d15095e", "value": "1536:eKOxMi7VgxWNioQRnRoHi2X1gaKwWj6Ks/XkmSlx3lJX6s03zxsvAx6vB:eZxMi6xWSaK0jSlLJ6iAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764546075, "uuid": "588676aa-6fda-49d6-a5bb-dd32e5819067", "value": 117720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764546075, "uuid": "0b3a7850-7e07-4e8c-b297-8443fda58acb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764546075, "uuid": "c60dc2c1-0f21-49f4-9b43-87900cfd0895", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77aaf9a-ce1c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764528318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764528318, "uuid": "dc9a0a76-370e-47a8-9af1-5e080e23ecdc", "comment": "Malware payload", "value": "11a6d20f66478ceb7bdb633a071648c6", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764528318, "uuid": "6ad387a2-9e07-4dc9-9224-3bdc3454226d", "comment": "Malware payload", "value": "dbfd1a47a0108c7075c813c498abcf4857109e72207eeb86f435e535a4e2ed8f", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764528318, "uuid": "e24e7abf-2fbf-4e00-8ce9-e61561869c73", "comment": "Malware payload", "value": "8d99100997ebfbdd12ef5d752bc86d1690704466", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764528318, "uuid": "751d7550-6459-498c-aac8-9c1de322e24a", "comment": "Malware payload", "value": "477aff6d0082154f9802aca7b91a6f8e13a65bc24dca7364dca3ed646b97bc238f1536944b9d1767ee2e346f6530cf84", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764528318, "uuid": "668a3cb8-d233-43b3-9c98-b2d75553932e", "value": "T1D1D4129762E274E8E7779639C421864AEBB3F4790261AF5F13A0069A5F371C14D2FF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764528318, "uuid": "16e4159e-4508-41ff-bbed-0effeb70876d", "value": "f35919722d8dcde279077a8460e70b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764528318, "uuid": "b8824f35-fd05-4b25-860d-14e71675d909", "value": "12288:0SuCbp9BGXRxp2vZWfLlZOaevIUFhdV/HDxs+SfC/mWd5gvfI9kC:0zESXzp2YjSQUbdpdifC/NYvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764528318, "uuid": "9cc7acb9-6a8b-4b2c-b32b-0ac0417cf3fa", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764528318, "uuid": "dbff1a3f-6636-4b4c-b7e6-9dc64335c531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764528318, "uuid": "5a9fcf9a-d082-4a26-bf69-6c1fc02abfee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d2d774-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468232, "uuid": "83b644f5-226f-4278-be3f-8b8cf14cd456", "comment": "Malware payload", "value": "4027ffc55ebbaa72816f2c91487795a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468232, "uuid": "337c0fe5-7db2-479e-b0dd-4ccc2123b449", "comment": "Malware payload", "value": "dc257c9dc469183d68a748ff6db69b87e68ba202763b7b3cee1a3674846b8bd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468232, "uuid": "e71dc83f-8bcd-4879-b729-1aac2c0db092", "comment": "Malware payload", "value": "038ae8a421e5a7123f35d234bdd5f7f5350b5a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468232, "uuid": "99baeb85-4096-428f-8b5b-1895bc8085ba", "comment": "Malware payload", "value": "76d89222de7c19c316cb8aafd00f71e4805d826f60f4b52b8890c93c2dad9676ecfb8087f203454e8e5ab9bb2bd0e1eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468232, "uuid": "7bcd2664-c4dc-4d70-90cd-8d7db306e60b", "value": "T17E16F75BB8D28942C4E43637B8BE81C433674EBA5B8A56566D05FE3C3ABF1D80E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468232, "uuid": "054180f6-4e5a-4687-a01d-b51c5adf4c0b", "value": "49152:OWXcEAqTr39d5b+lJym1OlW3l/jiFZd5E6:FXJj3BbQOlvvE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468232, "uuid": "a7403ee2-f37e-4287-94ce-c8d3b2137562", "value": 4128952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468232, "uuid": "a996c7b8-e683-426f-be7b-613d0a224edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468232, "uuid": "2c89ca59-ebb2-4e20-b387-454a8393ad30", "value": "bizy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a9ee37-ce3c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764541872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541872, "uuid": "59164883-af14-4861-a4bb-a4bed3fab608", "comment": "Malware payload", "value": "b80a12827df0d60e4cc37721422a5426", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541872, "uuid": "01a51cbc-2f3d-4906-b350-a40e4e56c61a", "comment": "Malware payload", "value": "dde939ab64a5b7c1d12082b4808a52cb5c6412a047044c6353b1d5121ae0f314", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541872, "uuid": "51b2cd20-2f0a-4d9d-97ac-f2ac89774307", "comment": "Malware payload", "value": "6e1a2f0f9b2910c9125348d4126e7eef167e22aa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764541872, "uuid": "b8339bd5-9093-4438-b224-ba7451a53992", "comment": "Malware payload", "value": "3a4a092d89a862e1d54a7253d0f9b26fbff0483f1ff273c745a08367c6e8c3267e245da060b1642076ac17a6df8ff1f3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541872, "uuid": "7aaa084d-8aa0-4c9e-a055-e77c4509bcf0", "value": "T1231833ADECA50E4AFC33C23AEE79968F839411C61A419D37E604C75356C7BD2BA7240D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541872, "uuid": "448c5d89-0cb9-4eba-b519-498a1ce5abfc", "value": "1572864:d+pSvlay6AiNq6KWKoUHXNjgDtLcLX7Bu/WqxqMbYEXh3X8W00F7waRlbXG:d+ub6AYq35HXmhQLX7BrqxEEXhZ5Vl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764541872, "uuid": "bd0f9363-c7bc-41f5-a17d-89a7f1f30a8c", "value": 92178678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764541872, "uuid": "3f971763-c8de-4cdd-bf97-1792d42610f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764541872, "uuid": "1d293322-bbf7-4304-8760-ed92511ade45", "value": "invoiceservice1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60059f12-ce27-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764532895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532895, "uuid": "4c8ae1cc-1f92-422a-9647-c2893b15345a", "comment": "Malware payload", "value": "55ee2b8079901b4b2472e8d1314103fb", "object_relation": "md5", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532895, "uuid": "32d440c4-4fc9-4f45-924f-c61d1f24ac97", "comment": "Malware payload", "value": "de53b0e53e1f33e964436798c2e6323a0396d0df6de874aecf2f4a6d7c1b4357", "object_relation": "sha256", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532895, "uuid": "ffa28961-fb92-4101-afea-ccb251850903", "comment": "Malware payload", "value": "9adc4ff021bc5bd15d548a746563b440a1bdb9e7", "object_relation": "sha1", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532895, "uuid": "6f4d833c-14fc-43af-be3c-4e20e6b51738", "comment": "Malware payload", "value": "00dcc0e94a1d5b5cd07e15925a9f5257b04f61721a7d051e82baa9f38d7e9e18c6babe72a379dc5e7f64af6680005ef0", "object_relation": "sha3-384", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532895, "uuid": "d969533f-1819-40bf-8a7b-da106431f49a", "value": "T1FE62B6C877E18576D29B8F788D7303122A30990B3218DF1B4EC4A5CB1932F95EE07DA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532895, "uuid": "065d89c4-21b2-4695-8cf3-df0c2e992ab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532895, "uuid": "7f57f870-d14e-46d0-98d1-c72dd52174b8", "value": "192:WNTroJdsQV++0OV836668ZKMbwXe/51EWBzEaE4vEv/37EoHE0l3mtE1EpEEv//5:+4JdsQKZKMbwXe/0V2sLR46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532895, "uuid": "9df9b521-aa1e-40cf-9fd3-f7acf2520d83", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532895, "uuid": "ef5b394d-d57a-44e6-981c-ce2c6472152e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532895, "uuid": "416b98a2-ea92-460f-beef-02e7715be07f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5042b832-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540170, "uuid": "52e4eb94-a19a-4e24-ae6b-1eca12bbd611", "comment": "Malware payload (Mirai)", "value": "53d18ce13c58b3a83fd1693e9235c650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540170, "uuid": "8cae95c4-f354-4654-813c-f02562dc005c", "comment": "Malware payload (Mirai)", "value": "de74f4bcbee689f0900e9ad580e7a69eb204d76a3137982f3d86389f1296b210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540170, "uuid": "e021f142-7ad6-46f1-a296-b5ec4cd5e3f0", "comment": "Malware payload (Mirai)", "value": "281763c9ece2393b4726bcd55980bd2dcdb692f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540170, "uuid": "7933009c-539e-4af7-be0a-126fe2a6e6d0", "comment": "Malware payload (Mirai)", "value": "a12c276a952241af43256e9e759a3c3468fc0825764970f967e3c8f332f3a9dbdb1a01b3c4d475838e5b3b6bd51832ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540170, "uuid": "a6a415da-ec73-4e0a-a922-3245bad08c42", "value": "T11993295BB8919B11D9C112BAFE1E118E331307FCE2DE7213AE146B2D778796B0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540170, "uuid": "fe0daa0c-dd31-4a39-a514-293839119d71", "value": "1536:SInT4AIS5mLSdo0AvfOj9nDyfJwMgiej4fPzauojgyr5HYLk0oSSHlq:BQLX+Zzj4fPzauAHrBQloXFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540170, "uuid": "df0a0fd6-4e6f-46a7-be99-cdeb25356908", "value": 95668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540170, "uuid": "f90c1400-8f4a-4d05-aa47-1ae988ad8b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540170, "uuid": "1bbf6405-0b4f-4222-825f-938790c07255", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419c29cb-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764530697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530697, "uuid": "8f0a47fd-7ea2-4a6e-9b88-51de283bf83f", "comment": "Malware payload", "value": "fc0091adfd3be9694cbbbbdd5a4358be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530697, "uuid": "79507559-1a44-4ef3-91ce-bc052cb636b4", "comment": "Malware payload", "value": "df0304444306ee9c8ebe5434fef4c7c426433248be4271a9e8dda37ecb2d2c0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530697, "uuid": "9e99d77b-2810-430e-b1d5-8b03c87a35b4", "comment": "Malware payload", "value": "b4db97de7985b6df640c7c86981543294f5fb974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530697, "uuid": "c6e66e75-9e8a-4671-b876-bd4629ddb510", "comment": "Malware payload", "value": "ab223e5b836fcbaa6bf77223d6e3e79a195f796cd856b0f8e1a1f20022b1ccf468dd77e746939fcb05325cb38cdc847d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530697, "uuid": "f114abfa-b11f-4343-afbe-168766e337c2", "value": "T136F32985F840DF17C6C6667BFB4E438C372617A8D2EEB2039D265F21378A95B0E7A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530697, "uuid": "eace94ca-a9a7-474e-a8f2-a89cd28007dc", "value": "3072:KhmV+86CU7ZAxPACP34zdR6yn342lYdlIiQ:Ems86z7ZAxYy34zd0yn3V+rIiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530697, "uuid": "83896e55-2aa5-446c-ae41-68f3aa4eb7ff", "value": 159024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530697, "uuid": "735fa30a-a895-4093-95ae-8df5af732038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530697, "uuid": "fc5e04c2-5b4e-430b-bc5b-8b1924bb9737", "value": "lava.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfe8d98-ce13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764524195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524195, "uuid": "e9f4165e-0223-4a7b-87e2-65cd72f31543", "comment": "Malware payload (Mirai)", "value": "2ef761cfa48225b7c93302606bc0a7d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524195, "uuid": "6cdd7b1b-ac70-42da-a155-b4915bb49d82", "comment": "Malware payload (Mirai)", "value": "df1c394a80b2a0e8db0ee19366b206562ab0d2ad03a195e63ee15848142c9163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524195, "uuid": "ebb627e5-9d19-4818-8823-ab89a72875cd", "comment": "Malware payload (Mirai)", "value": "8e55c9df75cb01f4a0b95e23dd2d14657f9ac557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524195, "uuid": "e641c319-032b-40f9-83cf-c3f739f0db00", "comment": "Malware payload (Mirai)", "value": "81b5a3428b6b8b41bd5cc71880b47dfd875db5c280371c59e4020811d53dd9b813900723b7d74ef09c90dcd858d2215a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524195, "uuid": "835a123d-4cad-4ff0-8933-2afc7aa9f622", "value": "T18A4302C51AE13026D0E6CD38D5BAB10A323C3BE5A6C5039D97E6341D98AF283F7476D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524195, "uuid": "c6a50395-ee5f-43ce-9839-3cd2a410cc60", "value": "1536:zooXtc3TGGbnOI5eBKIYvna03Sk4juIkH0N:Un3dbnOC//R4aQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764524195, "uuid": "3e452c06-62f3-4367-878d-f6a21402f2fa", "value": 58544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764524195, "uuid": "23b387f2-22ee-45d3-b2e2-5b3794cd4bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524195, "uuid": "9b7a500e-5997-4963-b4a7-301d47a7d14f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e07375-cda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764476539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476539, "uuid": "a97de33d-330c-491d-ad28-7f6765e5ab91", "comment": "Malware payload (Mirai)", "value": "ebdeff2284960fa5f100e9bdbc5b2a9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476539, "uuid": "16ef54e4-154f-4922-bbf5-84b52ab2b6c8", "comment": "Malware payload (Mirai)", "value": "df2cf820964205fee1aa77fab199f99edfe2994305128d926bbd97bcf3c8c7aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476539, "uuid": "b63e7fa1-394a-48be-8599-2ce2c7a2b1bc", "comment": "Malware payload (Mirai)", "value": "7b2c6e29d821b43c13104b306bbcb9d26a172038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476539, "uuid": "40bb5831-37db-46f9-baba-649cc564a102", "comment": "Malware payload (Mirai)", "value": "5e5c65fceb085906cb0a394b9facb98aa4f9fe285df7d0539d126967d9d295d47fb0b1a42f5a66a8a97a13f09412c7e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476539, "uuid": "23e49be2-187a-4fa9-91d0-5a016e08f0f7", "value": "T1FCF36B0779C194FDC8D6C2B45BAFE236DA32F4084134761F23D8AE262E5DF212B6E654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476539, "uuid": "e02225a6-1d82-4ff2-8caa-5f333d18e09d", "value": "3072:yzLmseTpVTe3xr43o27AxoR1B1rRu7Yqd9b6vaObdjOjU3zQc:yzLmDTW4FIQzYBbybIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764476539, "uuid": "c4871c27-6b88-4438-ad8d-328a479d79ca", "value": 161104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764476539, "uuid": "3b59693c-4d1f-4964-925f-e2de400dac5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476539, "uuid": "21ab9063-8625-47d6-9515-1f3d226cdf7b", "value": "SecuriteInfo.com.FileRepMalware.78696463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677dd91a-ce40-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764543645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543645, "uuid": "57bb75b8-d62c-4b9f-826b-8e11f3429fc4", "comment": "Malware payload (AsyncRAT)", "value": "fa3bbe453548653d5322ddbd6b033fab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543645, "uuid": "feca3797-8a6c-409a-9c76-25eba1ef9783", "comment": "Malware payload (AsyncRAT)", "value": "e09fe614b381c62e85aa5ca132b4277b7c74c6991bb35d222b84e3a7cc7cb6cc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543645, "uuid": "3fc5d90d-3b60-46b7-8c28-fd7fb407ccb4", "comment": "Malware payload (AsyncRAT)", "value": "3753c76cc7d75e4339ecc1d9b62420abbddd42b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543645, "uuid": "f46535ff-f9cb-4d1f-8dd6-e02e76bd6f69", "comment": "Malware payload (AsyncRAT)", "value": "a7fcd663ab01050858b308f985632b2ad8216c384dacd5606eef7fa92f7b0e6f5409f643212b2dc48c5c2d741328d9f3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543645, "uuid": "8c6d23e3-0de0-44ef-925b-c22bf8c17b20", "value": "T1B1638D083BE54519E4FEABB419F63326D779F6135D03E61F24C801CB2A2BB88CE516E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543645, "uuid": "87574a07-370c-4ec2-beb4-f86959439a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543645, "uuid": "5a0fe9be-7454-41b2-a557-e46a4248dfdb", "value": "1536:BMSl4SY6mc0xZ9KJdrNiMWYbRGBmHI5p6XO+VyVJ:GSk6md9K/RcYbRGh54OUyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543645, "uuid": "09612677-d1b0-4da6-99a5-2f8848bd44cc", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543645, "uuid": "84c03027-4c0d-437b-a9ed-ddf48eb30f59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543645, "uuid": "b2aab633-4ccb-4f9a-8f62-2593bce640d2", "value": "asfjasfjsfj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84ae91d-cdc6-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1764491409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491409, "uuid": "38de1dfc-45f1-4c48-88fb-15fdab915ad6", "comment": "Malware payload (HijackLoader)", "value": "627b9e77d72a873845f01b728555a878", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491409, "uuid": "f78eb637-8950-4065-b2c8-c9b6ed936959", "comment": "Malware payload (HijackLoader)", "value": "e0faf08ea3b166be17695d6d0de80018bad7509dc3afe8ac4318d5159dd77e4e", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491409, "uuid": "d80eb976-6268-4428-a5b0-573e3117716f", "comment": "Malware payload (HijackLoader)", "value": "30a5e9bbf3067e1126b77f5fe9346f0a95284239", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764491409, "uuid": "9668693d-358f-4cde-ae5d-916ea9b8c9d7", "comment": "Malware payload (HijackLoader)", "value": "70ea5e535eb6aac90a23fd602813c55f7b261db91c62314963f4e54269069e59de0f8f7e65b91a0f32209a03900fab45", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491409, "uuid": "2c60c060-8f4d-4a39-8211-1b2d13e96a5c", "value": "T1972633813C764FC3DDF65176CA7E0B8AA916DDACDB57E2666C8433DB21307A112AF042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491409, "uuid": "5f18487c-ff82-4cfe-9bfe-7ccf11428625", "value": "98304:05lvGU2NMr71jbbpSVmKkfuBWVhdc/T9u+wfZ/:0rhjHfi4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764491409, "uuid": "e1816594-3f5e-4475-aaf3-cb48a9793dec", "value": 4534272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764491409, "uuid": "9366fce6-49de-4399-8571-03fcccb164ee", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764491409, "uuid": "b45bcca5-b02c-469e-adaf-aeba85b4dc57", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6124794-ce41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544260, "uuid": "a25bb3f4-60e0-4d44-a057-18cc4b520cbc", "comment": "Malware payload (Mirai)", "value": "6456e20e60fbddb1d9d7c7395692ed7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544260, "uuid": "84839ea5-e63a-446d-8381-bf3c340b6e51", "comment": "Malware payload (Mirai)", "value": "e13c62f013c6dde3fa2fef2971e056f72baf6c49798989fe905df53419f374c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544260, "uuid": "ec20ed89-db89-4583-9bb3-ce2b4fd0d4dc", "comment": "Malware payload (Mirai)", "value": "9d60abcef756e55e99c7f935afafcc5b83b4e54d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544260, "uuid": "baa48533-9516-4522-ab4c-53631594c17b", "comment": "Malware payload (Mirai)", "value": "324ac62fc8d1acf57e548ea24cb29f5737e190a86075490e1ed46cb6ca06ce348c3560ef7e17239a0b57f975f40c30a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544260, "uuid": "2130f000-3058-49fb-96ac-82083ffb0b04", "value": "T13DC32902F58184FCC08AC1340B6FBA3AA936F1DD1238B6E777D4EB127D4AE615A1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544260, "uuid": "e63da30e-b5dc-42ff-935c-565953154482", "value": "3072:EOUdFRvCAf8ysqTiy4u164HfVY9RyBt86EaSzQCHJPQnG9yEn:VUdFRvCAf8ysqTR4u164HfVYijxAzxJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544260, "uuid": "782ef885-ef24-494d-9275-3bfec1f9c582", "value": 125344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544260, "uuid": "47d0d38a-f7ce-4394-8c67-aa1e1bfab644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544260, "uuid": "24e57afd-b42e-449e-b3a0-a03153d30e55", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6860c60-cdb1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764482360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482360, "uuid": "5b5a992c-ecd3-461e-bc8b-d475abaf17c9", "comment": "Malware payload (Mirai)", "value": "5bf067464fe820be656b9580d8682d1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482360, "uuid": "e855761c-2561-46d0-92e7-a61d8c66bbcd", "comment": "Malware payload (Mirai)", "value": "e1aff5b1e78d84ee46cf499e71f9c1555ea2e8ec07d6c75cd974ef1e4bfed9e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482360, "uuid": "1e5abce6-d495-4c45-be72-f695fa5886d3", "comment": "Malware payload (Mirai)", "value": "aba9f5c29ba08414e603e78d41306c31693c39dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482360, "uuid": "feded1de-72ff-4ea1-896d-64c5a5644b95", "comment": "Malware payload (Mirai)", "value": "c3b0c9d9d8ca37ad9111d0ea67f6ac0faed39422df3a7544a1d1e0fbff488ee03f2cc8a371c448c3289681752c2a6858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482360, "uuid": "9405afb5-aede-474d-81d3-9ecddcfb9a67", "value": "T10FF30941BC505F62C6E623BBFB5E428D771553A8D2EF72078D226F203BC695B0E76242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482360, "uuid": "dfbd51c9-eee5-4578-bc86-0f430d79bf3f", "value": "3072:G2PonjtJ1rK5AHN7GGjSVjvlepBSkpP/f/L4Im2jy8A7t7EjiM:G2sBS8H/L4Im6y82FEjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764482360, "uuid": "2dda2e1d-3398-4eb8-926d-59382d47dee1", "value": 170380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764482360, "uuid": "b591fe73-a67e-4b02-be50-0b893ad26e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482360, "uuid": "d79f9c04-bbec-4a82-9b6c-493569395fed", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d989adea-cdd4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764497451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497451, "uuid": "b4e22622-2674-4b5e-aa0c-29b92ab92827", "comment": "Malware payload (SalatStealer)", "value": "519b465f72f23d16f25c625ab9946f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497451, "uuid": "631afd73-4a0e-4d7a-865e-02e5bea50d27", "comment": "Malware payload (SalatStealer)", "value": "e2cc28ff3552f411c0e06f159da646bc328b90799e84736a2c0bd219644f14af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497451, "uuid": "5eafdf04-2882-442a-8832-1281dd05bd38", "comment": "Malware payload (SalatStealer)", "value": "28338f50b8bfade6ca564f9706d022ca6d92cb89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764497451, "uuid": "5e6c223b-18c0-4154-8d2b-75bce0a3e0c2", "comment": "Malware payload (SalatStealer)", "value": "7ce10271b419a74ba7bd58ee35ed328406ceca3150406f712edbd52b81c9e649c75ec21c707b26d27cc01a28029803d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497451, "uuid": "76f436ff-2598-48dd-82cd-79f4eda56034", "value": "T11DF52342012CF449CEBAD4B31A96FB41D0159E7AD591B6332DF0BBF09639ED7E938508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497451, "uuid": "664a0132-3602-4078-8734-aa1426e44205", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497451, "uuid": "8b9e305a-4c65-49e1-8b82-41c4cf4134df", "value": "98304:pvCSOr6QqcY9RNovYhbxBc147aiHWQlVGc7LWC+C:3OuncYNsYh0uGi2Zc7LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764497451, "uuid": "9848ba18-0ba6-409a-b7eb-97e5adc46b65", "value": 3397632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764497451, "uuid": "1f57f34d-58bf-4c3d-bfc2-26564cf90b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764497451, "uuid": "baf06b08-7cd3-4775-95a9-09cb2fb4bc19", "value": "FixDISCORD14.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f3bb34-ce26-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764532563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532563, "uuid": "1250da67-61c9-41be-8a24-20766bd26fa1", "comment": "Malware payload", "value": "a536db1b0b92fa0d91be22a5f6a9219b", "object_relation": "md5", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532563, "uuid": "fa1ed87a-e07f-4974-8b6b-c55f30f9730d", "comment": "Malware payload", "value": "e3d40c26670aeae96ccf8bd3d5982fa9a364d29aac4a0a9a7937ae732e089643", "object_relation": "sha256", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532563, "uuid": "61d58d1c-b4db-4a00-b8b1-9813f4c1dba7", "comment": "Malware payload", "value": "d3c4e1b947afc9124b888a9f66e0e71368431239", "object_relation": "sha1", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532563, "uuid": "da7a667d-dc2c-496b-adeb-e8b44df07ff8", "comment": "Malware payload", "value": "2306b161830c3bc444f99026acbccd23b4ee6ef74f254cb7110c56a0728b779d612c875edd5f2f30dc1acc5377a2af63", "object_relation": "sha3-384", "Tag": [ { "name": "bursahotelphuket-com", "colour": "#8937F6", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532563, "uuid": "bb2868b8-0ae2-4406-9565-cb60105ba0bf", "value": "T1171733F0872DB5F4C4C83B8F78E9602E726F4A9AB01D51855FEB861B00EB3352275B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532563, "uuid": "2439749e-c794-484a-94fb-50198ed3f555", "value": "393216:fAu1tSEA6bKsNHygD6B6gbn88ClO4vX8XFz3wBKVQuM9gbhQ6ExG:f/106bKDgD6B6QeU4IG6QuagbFExG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532563, "uuid": "2b9ab2d1-23f6-4319-b851-0ea29ebd1e03", "value": 20007613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532563, "uuid": "0638730d-cf83-406c-9fe9-3de96c44a7b3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532563, "uuid": "c4f6865a-05a1-4321-8379-9c768b6efdcc", "value": "Feastables.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4e1a59-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468169, "uuid": "0f18cc1b-b28f-4f43-b49f-1e5cf73a5d06", "comment": "Malware payload (Mirai)", "value": "c4f72ac349500635906518b2486a552f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468169, "uuid": "98ee736a-75bc-47a1-8aae-8ca5c3f34e6f", "comment": "Malware payload (Mirai)", "value": "e439140f9ab57169b1821f08acbf095ce275c3d4e3107b4d52da9179c3e17661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468169, "uuid": "5782569b-add2-4208-87cd-56742046cea1", "comment": "Malware payload (Mirai)", "value": "23988fa7d9722cb69ca6ac095f0ef0279de275d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468169, "uuid": "93456746-c8a2-4de1-b75a-a77153eaf848", "comment": "Malware payload (Mirai)", "value": "45cf0dd1e391071259cddf66c7fcec172afb96c3573c2331992884707ae15d0a881e6ce681d7a1baa0ab6b3ff2a06688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468169, "uuid": "b72b86e9-4144-44cb-a89a-f477bb3d9b7e", "value": "T16AF3E916AF520FBBDCAFDD3702E90B0139CCA55B22A43B363674D528F54A54B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468169, "uuid": "c689e554-b4dc-4408-9294-b46c750847c0", "value": "1536:UtfjgPCou6P7T1LJa7vv0YxRXIHBQ/HHZLOIiTmgCIOALrerF58qnCwAJe:UxjDo/31fhQ/HH/DIOkrebnCRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468169, "uuid": "8e5df063-4631-468e-8413-832f5a95d407", "value": 169388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468169, "uuid": "1d90a9ca-e650-488b-8cbd-4a04ea074684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468169, "uuid": "e9f20e73-259e-4bf1-a642-35036fa9b811", "value": "odin.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a43743-cdb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764484721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764484721, "uuid": "83d80f1b-877d-456b-a738-4da34a2a51ff", "comment": "Malware payload (Mirai)", "value": "f2f629d651bc82188df8b81c3a021541", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764484721, "uuid": "95edf7aa-7abf-48c3-ad21-dfdbd28a0c33", "comment": "Malware payload (Mirai)", "value": "e4c6cae8de7e3a94f3211f79b35d8cf5760a4d93f8f62ab48ca7d17f978692d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764484721, "uuid": "4d7189ad-a523-4937-8b88-addd5c495dd8", "comment": "Malware payload (Mirai)", "value": "4ed36fc7caf8c582be5422d842938758d5453289", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764484721, "uuid": "f246ed2b-06a3-4e27-94a4-db7264b7b90c", "comment": "Malware payload (Mirai)", "value": "323b9c6a73d760ee699c5b0afe25d8894023ed3c2d125de79193f5a0e5d4d7876e4978145d7d2904f87dadbc9d18551c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764484721, "uuid": "08c3b16b-8519-4df7-964b-ba0c803695eb", "value": "T1DDE33B02B30D0947E2A32EF43B3B27D193DF9A9121F4E644255FAF8991B1D32558ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764484721, "uuid": "fd546d63-045a-43b6-a9cf-686bcd5f218c", "value": "1536:7HWeWx9PqeVYjtX6dXDnZxD86AwDRoA5tdmq+lMYu6i/mUvhutHEK4hqxiEpvAw0:7HzWx9SiZDnZxLACXtddhupn4FlwKiPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764484721, "uuid": "c3b0b173-3ac9-448e-97eb-0afe5f33c213", "value": 156940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764484721, "uuid": "27e4a480-6442-488e-9e4f-1370a9128855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764484721, "uuid": "1fb0bce1-058d-458e-acca-0b6b6db383f9", "value": "irannet.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8cb862-ce31-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764537295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764537295, "uuid": "80bf7bb0-0c11-47c6-89f6-61dd4fff7a31", "comment": "Malware payload (Mirai)", "value": "7fbc8e19069eebf4ed9d2a58a0afc16c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764537295, "uuid": "24c0e403-813c-4c40-af05-73dd1301326a", "comment": "Malware payload (Mirai)", "value": "e554d051e73dbb8ff79001932ee8ab5e6052d2437271888c0935912731b32679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764537295, "uuid": "9d1083e2-6b61-4ef4-92ad-64f500114f38", "comment": "Malware payload (Mirai)", "value": "0b3db1f8919497558f9766bcdc607b6a71dcd647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764537295, "uuid": "e26ca4db-2e59-43b1-97cb-12106d46854e", "comment": "Malware payload (Mirai)", "value": "f66d89118b499f32f81e1a2d32413ba285f0de4c7dc210af2222e92f8b8eb661f13b55aad08c9ee4a88599dc7fd62748", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764537295, "uuid": "e8d3f004-c347-4dab-ac20-e607a6b58a35", "value": "T108D33855B9825A27C6E523BBFA2E028D332563E4D2DF71178C215F217BC681F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764537295, "uuid": "bc04acb2-1c78-4323-a614-9ab18385e1b3", "value": "3072:O7ML7bMJZp39uIHRy1USL4kMWDpZKzeQGt:O7Mip39Pxy1USLNVpMqQGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764537295, "uuid": "dbd5d483-8738-4e7e-b51b-39a325945c82", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764537295, "uuid": "a645c437-9232-440c-a867-c1ef38abab7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764537295, "uuid": "f81e1c92-18bb-4de0-9809-d754a6b4456b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f620fa-cdc3-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764489934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489934, "uuid": "a55aa5a9-0024-45e3-a922-140c8c4ad37f", "comment": "Malware payload (Stealc)", "value": "1526e6d78347a5daff1cbe281f7b91c7", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489934, "uuid": "1471da13-35cd-4917-82bd-7521a5c4c197", "comment": "Malware payload (Stealc)", "value": "e5b3f4e0b7a7b8c5e4baaae80138b5ce81b0071acc57e125e552d629fb901729", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489934, "uuid": "42d00930-2f8e-4309-acbd-9e1ec00faeb0", "comment": "Malware payload (Stealc)", "value": "be2f88020e193700b00aacc21120c52d422374ed", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489934, "uuid": "3ecc98c1-8366-4fd2-a8df-e6862b1e8908", "comment": "Malware payload (Stealc)", "value": "e63640e3fb5e31dfa07586bc6bcc150516b3d9c5aff0c16809da823b04dc9920d6a1f5e841aacdef00ea962bba4e4780", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489934, "uuid": "a655f7d0-dadc-47e5-89a0-d385bb030ad9", "value": "T16C160717A991CAD5D05AD238B8B261C1B3757C4C0B727BD33A807A762C3A3C85E76F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489934, "uuid": "656b1c4c-9e01-4ed7-a770-e90ef3a90132", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489934, "uuid": "00e5a47d-6d4e-4d15-a1b5-36d15ce9911b", "value": "49152:yxyedPCzuPkX950+htHdkBKtPdxaVGwrktJnCsfj8Eq7PXO/1i5Xmwxo27InpM33:yPgvXUeOLFRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764489934, "uuid": "882108f2-4fd6-4077-b176-f534e2943d5f", "value": 4324352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764489934, "uuid": "97d13e05-67c1-4656-9840-9c630b1a4b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489934, "uuid": "e979cd5b-053e-45ee-b49b-61d6768cf8ba", "value": "download autodesk fusion 360 full crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85057feb-cdd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764498168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498168, "uuid": "62bbacef-05f2-4da4-95bf-5e65600d07c0", "comment": "Malware payload (Mirai)", "value": "7d630c9c7760aee40e0087d12da54e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498168, "uuid": "b2447425-9e0d-4140-8568-9cc240efcf83", "comment": "Malware payload (Mirai)", "value": "e6410e30a5474a62c39f5c4f96de14fc422cfa73d1a2d5f1e10429df543fd1e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498168, "uuid": "23e18bf5-ca4c-4ba1-840d-d1d9ea384457", "comment": "Malware payload (Mirai)", "value": "c3bf4c3406fe89c23c99495b013a86f5c7ef4874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498168, "uuid": "6e8375af-9a8d-4ddb-a48e-c85ca2929f31", "comment": "Malware payload (Mirai)", "value": "08c5adbbe1c3a449c16a86e45873948b39d54802af5c314f855d9bf35fe1fcc172f97aa6159b926272015de7a41c81ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498168, "uuid": "efdd8fe6-bb14-4f9d-965e-ca95cf477573", "value": "T1C4436D42321C4A57D5975AB0283F17E093BFA96021F0B7CA754FAB5A46B5F335086F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498168, "uuid": "1cdb2f65-da5c-4d3f-91d9-2958e4541daa", "value": "768:JJACq4+ClOLRfadpR8zKx9n/JtVYziCZuoWTnznE5caM5fR5oG0uiKSKug7RT:ECq3qEqiKvB5CZuDUrMBRWG0ROug7RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764498168, "uuid": "22913e16-bd18-459b-a299-91cdf869c991", "value": 60072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764498168, "uuid": "28d3cfb0-854d-4f47-94e8-59503b9149e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498168, "uuid": "39a7858e-f86d-4c23-bc70-7ef0eb168d6d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcdee2f-cdea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764506884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506884, "uuid": "1175286b-4327-4677-ad45-50e4e50816c2", "comment": "Malware payload", "value": "f3810b1ebe5a5e0d9c7e87137521ff0a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506884, "uuid": "818dee2c-0bed-48fd-87e2-ab9d94daf54c", "comment": "Malware payload", "value": "e67783d0fc3ab50f19708e77f5eb3382442e39ad654a12c3e6ea96bada3b621e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506884, "uuid": "45b0edc7-1bdb-40b5-8de8-b58766fc121e", "comment": "Malware payload", "value": "55f3a23b7c7f2021fa1227c3f79c96888e736ae0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764506884, "uuid": "b004c5d6-a4d8-4632-a062-8d09cf1c8508", "comment": "Malware payload", "value": "e7e3ef5cf62c29cfea0e7bd8f5c4e435c79ea75b92bbd560ab80cb5b06ada96be0c85972ce0307a800599284da380f3b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506884, "uuid": "da451f93-16ff-4027-9e69-b972af82c54c", "value": "T12A4166112CB137EA0F0B612E06C5EA225FEE96CB3564DD1CB41A00C46B6F4EB0699A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506884, "uuid": "bcb16d5b-c655-4fd3-8b80-9d11bb94fe0d", "value": "48:bqRgXD+hBJTPEE08XT4LR0iEbzhU2n44JuNeI9s4GptRz21gNUyH03+uYIW:bGgXD+hBpNKn7KB2SNUyH03HPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764506884, "uuid": "63e5e0f1-709e-4761-b9c4-da350226affb", "value": 2434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764506884, "uuid": "079aa28e-5c50-4c43-81eb-208440107d95", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764506884, "uuid": "c53dfd8d-9df1-4e5c-acd7-44adc0cead94", "value": "Windows Update.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a06fb1-cdef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764508937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764508937, "uuid": "d91c247d-73fd-46d4-aeb8-94dccb2f3d90", "comment": "Malware payload", "value": "fe127a24d85348b7f8787fdd0f244465", "object_relation": "md5", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "obfusc", "colour": "#245112", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764508937, "uuid": "e7887e8a-e4d1-46d6-80a8-e00ed64fd30e", "comment": "Malware payload", "value": "e7223a8697559f73b0ef37779aa1e951397f5a9a9e0bad6416244892c03347a1", "object_relation": "sha256", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "obfusc", "colour": "#245112", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764508937, "uuid": "a1c93f02-9c21-488e-8920-4a68a0bf5aa4", "comment": "Malware payload", "value": "5249b47d3e6a89c82492a888bc5b40b516617499", "object_relation": "sha1", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "obfusc", "colour": "#245112", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764508937, "uuid": "80308676-b25b-4b01-81b6-22b7cacd323e", "comment": "Malware payload", "value": "47ca16cfaab25ec6d19c67d5321daef9442d0caf5ab37773e1b45c9c6bd0907872a788fc1540948367e2a253657ca641", "object_relation": "sha3-384", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "obfusc", "colour": "#245112", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764508937, "uuid": "07ff977c-b742-4225-be82-14edd9dd8aad", "value": "T1D6468C17F59641F5C06AC174DBA79726A670F8998F30AAEF429847212E53FE01F3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764508937, "uuid": "8416fa30-ba5c-4a39-a7d7-41551b420f9c", "value": "ea5924b17580be04b899e21fd3d72352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764508937, "uuid": "73448686-d8c8-48e0-b05d-3894aba7d794", "value": "98304:0E/xCiNFTNH6053cu5fVX4Avskd6o0/H+mgcik4FrG+TWd:vxCiNFTNH6053cmlC/H+HcZ4FrG+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764508937, "uuid": "1a831633-a063-4631-bf4b-643f3d86bb2e", "value": 5765776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764508937, "uuid": "085d26fb-65a3-4f69-b7ee-d17e9cf8228e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764508937, "uuid": "08be3a64-014e-4ac3-8f1e-32f5845ae8f2", "value": "fm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efa5877-cd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764467261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467261, "uuid": "ab06a2c1-61e5-4d4f-8fb0-4b5205a46a5b", "comment": "Malware payload (RustyStealer)", "value": "a4f9c8e107f32e094cda6ebecaf12798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467261, "uuid": "98d14880-fecc-49c1-8368-d3017ef6fa47", "comment": "Malware payload (RustyStealer)", "value": "e7eec76f4ea8e6e2dc7e6415bc54ed74ff8bdd16ec81af6e8716b414ec6cb175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467261, "uuid": "92294baf-95b3-4a1a-bf9a-6692f564e002", "comment": "Malware payload (RustyStealer)", "value": "7777ede5bb7ebfca0a1ee2cb1407f7a4fd52a9aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467261, "uuid": "0550bc1e-161f-4fed-a99e-5cb0d19c80e0", "comment": "Malware payload (RustyStealer)", "value": "8a986019a68da42f4bc88b7c9fcc881580bff9e631c1cb462311bb59425d99d24602c01e71d3d6f7ad4989ca8796c993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-byt3d4shh", "colour": "#02FCCD", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467261, "uuid": "6a59720b-139a-46b0-9a1b-6c439437f7e5", "value": "T1CBF51843E79600E5D5BAC175CE169227FB71385807F1A7A772901AD22FB2FB07A2D384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467261, "uuid": "56183144-4992-4698-b3fa-7204796031bd", "value": "3aace7411a0ffcdd8fa474a0829fe548", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467261, "uuid": "3447edc8-cd88-44f9-b0bb-e2848d8a9ddf", "value": "49152:NwVlIvTWXOKiEHkgvcje2fXE4ryOvbFhFAIJURc01AfqkNIY7RpJfjZLl:QEcchXE2a1kNIEdfjZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764467261, "uuid": "278a3d98-c220-460a-b976-6949cd603c8e", "value": 3638272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764467261, "uuid": "0775a859-9d40-4b60-a432-5b4d5da6ccb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467261, "uuid": "3be16084-e9ae-427b-a82f-40d9645d86cb", "value": "Stealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a2c87c-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490625, "uuid": "07152b0e-7d8f-45a1-8da5-5f0ea2a8b111", "comment": "Malware payload", "value": "09274b4159162408fbcda84832090ca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490625, "uuid": "8717b832-58fc-4c60-b85d-a57e19151e35", "comment": "Malware payload", "value": "e81a9ef97b73ebb5f6b3811c770638757ce90b189d3b50c58a311bf46ff86624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490625, "uuid": "f3736d15-9efb-49c3-af77-f7c3c34755e3", "comment": "Malware payload", "value": "f48625c4c408c01ef7837fbee8d5b09ab4a8a7c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490625, "uuid": "e9c1140f-94af-4d9b-8d71-b95c2cc490f4", "comment": "Malware payload", "value": "a631f3c72e644d26e9bdfdbec1beecb0a0179fd75a38b450d0ffb8b49592efefece41256f3c0d7cc79ac2b31ee9e639f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490625, "uuid": "f585d568-3c6e-46d9-a36a-e2ec78808b4d", "value": "T17FE7336EEE96EC2CF4FF8073A17A2B8970B456163416DD10F89932C69D7B2517283C8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490625, "uuid": "5984e9bf-1afd-4af2-b959-6ba1582c3428", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490625, "uuid": "e790e588-6b4e-4c90-a59b-fdb8f7542792", "value": "1572864:Dy3mSn09iclUAH+wZj0W5+5XUAi/YrFr+pJVFsrnJDV5AAcUfXtTI1:m2SneicrIW5+5kAsIraSrJRKUvtTI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490625, "uuid": "0ddba75c-e8f3-47f2-8540-4fdffa6742e6", "value": 63787520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490625, "uuid": "1a25561c-4e7c-405d-972b-4f173e71e520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490625, "uuid": "654fb433-923b-4823-819d-f1a8267b85d7", "value": "Remotely_Desktop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9767b7-cdd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764496757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496757, "uuid": "a314aa43-fade-4ceb-885f-7858ddbee48f", "comment": "Malware payload (Mirai)", "value": "4dae8603d75baa18ece1d724f9c356d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496757, "uuid": "99e22518-6cbf-4483-a50a-ab26c1dd58b6", "comment": "Malware payload (Mirai)", "value": "e8617c00ec6676755bf80d636a7087e2a49551e8843c5c7f44a9d69d808515f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496757, "uuid": "ada0ca6d-6282-44e0-80d7-4153e2f31e51", "comment": "Malware payload (Mirai)", "value": "896bd3c9483f97489bcf123d26ca6f108ca87940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764496757, "uuid": "af1c5156-5691-4f4d-87c3-abd12ad6b891", "comment": "Malware payload (Mirai)", "value": "08bc5dfbd7e776b155742587636bf3525ba8728d83c849661a859d9e0d669cb7b87449dcd7e27e35625e524af9d775f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496757, "uuid": "8d009f4f-5110-454c-99c6-d77204b410a4", "value": "T19D24E80A6F510EBBDCABCD3702EA1B0129CC541722A57B767274D518F54BA4F1AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496757, "uuid": "5ce4dffa-067d-47a0-a40b-bc2c543971de", "value": "3072:B2JZLxaR4/EUIxmKxY8LNqDcdE2+J6hh1Ph0s:B2JZLoR4/rIa8LYGE6h0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764496757, "uuid": "ef0bb2b2-31c0-4337-86aa-fa46514f3a5d", "value": 211956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764496757, "uuid": "0aec6937-6492-4c5c-9c0d-95652ccc9491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764496757, "uuid": "e5db89fe-cdee-415d-b1ef-20608a9723af", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c4045c-ce27-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764532766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532766, "uuid": "3c5c9bd4-7991-4df7-8b94-1408c5f28ed8", "comment": "Malware payload", "value": "3451336f6d230bcc37c8550fc0280354", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532766, "uuid": "8238f28e-150b-42e7-989c-4448c900160a", "comment": "Malware payload", "value": "e8bb1ec4ba8be3425ff06dca443b6341ff797d6b3a0b9970ef50b7dd4078eebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532766, "uuid": "4d1920b8-5486-4a79-96ad-16cca8e75aaa", "comment": "Malware payload", "value": "f4813ba103521462ff74653074b2afe3c81983f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764532766, "uuid": "0d4cac6e-31c2-49ef-8e39-643f368249d0", "comment": "Malware payload", "value": "1b890c099dd14fb1051e38e02a5d6e0bf5bc5bb6025188ceee3d2135646c26a84dbeb26321d4ccaba5cc708cb64fce16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532766, "uuid": "8b5feec3-8cd0-4a7e-be58-ece27b1b9b61", "value": "T155337C7AD46BAEE0D09C4674BC6589381F53F100D6521EBB5A86C9AA8043E7CF61E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532766, "uuid": "cc072278-50a2-4f2d-802a-9934e1cc12bf", "value": "1536:Gaewt1ocn+QgOlu3kmesURp/5Ylu/BssCEeu:GplcDLk3JwTBYmBNMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764532766, "uuid": "d788bf34-d109-44fa-882b-2489aa39a2e3", "value": 52268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764532766, "uuid": "4ea049ae-05f1-48ec-8b03-3c820227e3d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764532766, "uuid": "c8a31264-51cb-41ca-bd4c-e73445a7e8f7", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5585bc-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490609, "uuid": "67976b5f-4f7e-4abb-b712-e02c34cbcdeb", "comment": "Malware payload", "value": "08c5b07012443a58816daefed0d03fa2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490609, "uuid": "d1a11601-a235-4729-87ac-1be46ca10c49", "comment": "Malware payload", "value": "e8f94401801538a0d3ec34ed2565fb6a0ebb15aa595ee58df38f213ce174d7fe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490609, "uuid": "726d9d5a-03b6-42fb-b526-1a7e091ee384", "comment": "Malware payload", "value": "3161848f7839ab0fedfef9e5819b1b98e238ac16", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490609, "uuid": "0dd11f2c-0822-4452-a4db-4b4ea90708ab", "comment": "Malware payload", "value": "21d4f238138dd75c91d7426dc9be8dc9c7a390f11f3a35b35e052ec67d96d7874688c0bc2fc9a1f032d587fe1f88fac6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490609, "uuid": "82b38b77-47df-4165-915f-c405b426138c", "value": "T109A533A0D10B34ABEC10E41E0E8B700BE968B48F522917676CD97BED90D66F715C772E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490609, "uuid": "7a6a9c92-6e63-4c1a-b651-22ac476bc7be", "value": "49152:mkV+2cQiIYa0lVDPnRBogkSQCN8DUSL2iyJPzx34:vsQ/10sYQJhlyJB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490609, "uuid": "27702b24-6ce4-46a4-9ec5-289a62c1c43c", "value": 2079426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490609, "uuid": "8c6cb388-e4b8-43a4-922d-7080827e361c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490609, "uuid": "f187bc8a-2fca-4b3b-a411-9d1ba040c024", "value": "TG\u7fa4\u53d1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d518ae71-ce12-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764524072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524072, "uuid": "b9f3be75-c64d-43f8-864d-50ee95fdd2a7", "comment": "Malware payload (Mirai)", "value": "795e9504fd389c943513dfb71c4b0743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524072, "uuid": "5c0ea55a-551d-4aff-8047-6502c6f7b4bc", "comment": "Malware payload (Mirai)", "value": "ea572c241bcbb3074abc231a0425bf6a00511df62f1bbcaa9bcc5111d7f06898", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524072, "uuid": "9fde9c11-1cec-4066-87b0-21f870cdb23c", "comment": "Malware payload (Mirai)", "value": "8b3eb0af294104a1af7693f5f03cd238995c18d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524072, "uuid": "b18a3256-3635-499a-8f63-32df81cabb24", "comment": "Malware payload (Mirai)", "value": "0c6f2b57482bbe865d4b2a918477c308efac285f548c937d3d85c255f5b1cff4c1740320e1f9506963801eca742ec7c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524072, "uuid": "87bb6689-e261-4659-b76e-82545248b0af", "value": "T11CA3E80E6E65DFACF76DC33547778A25979833862EE1C681D16CE6006E2034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524072, "uuid": "a1bf794c-fa5f-4852-b1ac-bef226bafbdc", "value": "3072:gDjiMxblev0RmYS5EXRJblevPRgXS55pc3YvO6xkc9yg10fXpLupUugdYv+:npc3YqMyrvCmYv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764524072, "uuid": "58c007ee-6dd8-4b29-9ef5-8f89fc500fe1", "value": 105632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764524072, "uuid": "8c3fe3bb-fb5d-4ada-aefa-f105a5f1a212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524072, "uuid": "7e0d4c59-b254-484c-87db-6508d8bdf823", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16485434-cdd7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764498412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498412, "uuid": "d0c9f8ef-eaf4-4e15-9158-d485cdd5d8c5", "comment": "Malware payload (Mirai)", "value": "3cf00eaad3fa29e741504874b79644c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498412, "uuid": "91e261d0-c2bf-4cc8-8535-6e209e3f1827", "comment": "Malware payload (Mirai)", "value": "eab139d32420f9cc196c13322dfbbaf425f3b35208a7497b42351eab89287a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498412, "uuid": "7577289c-e9a4-4e21-9657-23efc2926cdd", "comment": "Malware payload (Mirai)", "value": "879e7a2c75c911c98b247f66b2195542b6e9d691", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498412, "uuid": "8da56d1c-aaa5-4929-9a06-53d6d47b8ee6", "comment": "Malware payload (Mirai)", "value": "a5a00a11e0834d9bb328dbe1b4a5e451c36f5282f700545f82a0ae24c079a57c9e961be4708ebd853c62574429a4cc55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498412, "uuid": "0ef07826-1801-4012-a01c-6ad65989a3bf", "value": "T1F7530841BC91CA57C6D462BBFA6E41CD332623A8D2DF7203DD116F153B8A82F0E6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498412, "uuid": "c7bb4b9f-2f54-4393-bbe4-ce9f5c6c595d", "value": "1536:LPVQUOStxcE+hkTydwHWWvzqmAHwgH8tug7R:LPVQUO46wHXvzwwM8tug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764498412, "uuid": "458baca4-01b7-48c9-a4e1-9767da1762f2", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764498412, "uuid": "e2fea42c-9e9e-4f71-8200-b8fd413d8819", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498412, "uuid": "84ec097b-961f-48bc-a528-bff982570022", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cacbb5-ce13-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764524235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524235, "uuid": "05153880-cce8-42c3-abb6-b8e2fb57a29d", "comment": "Malware payload", "value": "21bcc418949fc344f9d4e01136dc4a45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524235, "uuid": "926855c4-0a95-4a1d-8a59-9083f34c35ef", "comment": "Malware payload", "value": "eb2b566e224860bcd08a9230d645c454745f7cf7b8138e7041e377489e535053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524235, "uuid": "0ac42ccc-c38d-4c2f-8a5c-d64d6f67fef5", "comment": "Malware payload", "value": "8b30867e958749782f519801cdaf86f48e17535d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764524235, "uuid": "c6a53bd6-1f8b-4508-9508-c54f6324c8ea", "comment": "Malware payload", "value": "2bb5c67e866f77f86d22f2e1e13243d72c83ea8f76499334e9a784aab94c1a78d612f6eb1049b155f2cea4067a08bce4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524235, "uuid": "f86459dc-3e96-4399-bef8-250b1c5debdb", "value": "T1F1D3E746BD418F13C5C722F7FBAE42987B267F6DD7EA3102A8257FA037864D60936211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524235, "uuid": "f053debb-78eb-4720-808a-c441bf4decfd", "value": "1536:A+/MmuRQOGCKEp882QZab4V0RvbUNFhdRd5IJ3xIwH0lXGYcwywAsNkIk2NTSbIg:A+/MmOFG688hY48vwLhdy3T+mcNSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764524235, "uuid": "0215279c-075e-4fba-92e8-33074d9086a3", "value": 134720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764524235, "uuid": "4f237491-fe83-4499-a4b5-12b7a108ef47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764524235, "uuid": "21b40c3c-b118-4244-81bc-9ed8549eac2a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb6f4b0-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540168, "uuid": "8c030fca-4795-4d7a-95fb-87d0dbc6bc70", "comment": "Malware payload (Mirai)", "value": "2d549889fb81430217511d55a56e9c23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540168, "uuid": "da06491c-d3e4-475a-92ca-5511bc4ac680", "comment": "Malware payload (Mirai)", "value": "eb58e4bbb5b0ebf0d2e972fe7e4052101409dcba1e484ac6deb2b93f8b214844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540168, "uuid": "a7a57a54-43e9-49a0-aefc-723e875155dc", "comment": "Malware payload (Mirai)", "value": "0d9190708caf72b371fa1d3ce8565926339fc32e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540168, "uuid": "3b982534-97fe-4aeb-8093-8d8fc14c179f", "comment": "Malware payload (Mirai)", "value": "856ed57c993e94d6998aed75b567e63ab5a13198e0fdc4958e70321b3782fecd380b29dcc5b1b77c4d635bf84f4dcc72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540168, "uuid": "3e6798c5-7023-4be1-93f6-eaba2287f45f", "value": "T1EBB2D0CC60843184C68D7C7C278D4A664F6CA0C0BAED9B16E350CDD8B3BEA8B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540168, "uuid": "b76ffe23-a99f-4bf9-8fce-fdbe94ed75ca", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp8ZqSWvm:4QlS07FUXqIYSXQKquEq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540168, "uuid": "a8f4dada-04fa-4897-8f55-78c45706f371", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540168, "uuid": "0288e6a7-4c83-4cec-ac0b-d95a60759b07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540168, "uuid": "4ba1034b-1445-49f7-bbbc-af876503b07d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5d0ac3-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540165, "uuid": "db49fcbd-a433-4d3a-8378-5ee1177a55e2", "comment": "Malware payload (Mirai)", "value": "a6043b7285a60a2f5b34885829fb7246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540165, "uuid": "f0ccd2ad-71ff-4a55-b3cc-a69d220a40bd", "comment": "Malware payload (Mirai)", "value": "eb8f15a1fdf4bf7ef0db85f0b9f34c131448f2255d414e38d9c81e83383305fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540165, "uuid": "a84a2135-7d34-4fbd-ad4c-03f7eb4282f1", "comment": "Malware payload (Mirai)", "value": "cd3a8d4092aea40f6faa47ecc7dbd8da6d1e216d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540165, "uuid": "11421014-a4a4-4ac6-a288-bca5b4eb13d7", "comment": "Malware payload (Mirai)", "value": "c0c52080582475ba331dccb5e4ed902b4aaed198ae84cb9eedd52fe2aa103078c01d5e13b6b1283ff1b834a649db545b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540165, "uuid": "115dbeb5-ec4d-460b-9b2e-21ee21f0278d", "value": "T19DA2D01472632D65E3ED2C3DC96E8367B9670BFC80F6327679415A20C90924B3E29A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540165, "uuid": "1ed1a07c-1c4c-4348-911e-73027c318ac0", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjM6hymdGUop5hf:vvQn4j+ZO5fKAlxg6s3Uoz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540165, "uuid": "09f78031-731c-4cfd-8fe4-22a9761a748a", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540165, "uuid": "f04e7f83-c9c3-4f25-892a-7a9455734b1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540165, "uuid": "f2900e0b-6f7f-471b-9743-00a92d998fc6", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707ae893-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540224, "uuid": "14a33fa4-8667-4508-aa32-524070457aa2", "comment": "Malware payload (Mirai)", "value": "44e1c0dda4b3a046dc5b62ddad5e66af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540224, "uuid": "72bf32d7-65ba-4b72-a346-5a05b2e67dc9", "comment": "Malware payload (Mirai)", "value": "ecd6434c23bb568ec8e2673f036a3e96be2eccab7d5aba792585bfd38d695cb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540224, "uuid": "8b9c927e-9444-4696-a032-17d747ef64d8", "comment": "Malware payload (Mirai)", "value": "e79416b70b522edda483da8401c3427fbc9a7c17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540224, "uuid": "04593956-d0de-43c0-9c25-52a1095cd5a6", "comment": "Malware payload (Mirai)", "value": "a492db71ef7c84ee25a1856ee705f0a9c67be2bf6412f585bed249915bf39a091666bcfc6642625413560bedd6ad8196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540224, "uuid": "1360e708-abc5-456c-aae6-2eb08da01f55", "value": "T1AF631BC4F5C785F5C81B893860ABF73FCA32E57A80719BADEF8A5E32D6277015201259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540224, "uuid": "26090481-69d9-4429-b9a5-61fe661efb00", "value": "1536:99IEpE5HVjXLoHRCVJzpTXwp49cuPbYAeWky81:4EpE5HVjX8HyDT0EcuD9bkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540224, "uuid": "12456672-d544-4729-bbd5-49b0dc41f35d", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540224, "uuid": "cd09c071-4ed9-467c-a009-4ae89af38a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540224, "uuid": "5efe97f5-bc8c-4983-83dd-dc2c90400e30", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b080197-cd82-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764461939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461939, "uuid": "a545091d-b088-4ba7-af25-1d6f33c167d2", "comment": "Malware payload", "value": "ad71e214e45836fafaf4ff17c3cb2776", "object_relation": "md5", "Tag": [ { "name": "alphazero1-endscape-cc", "colour": "#8D1BE7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461939, "uuid": "29620650-4481-4808-90fc-665a8a7e0ae7", "comment": "Malware payload", "value": "ed4cdad5e9d531136d99acd5b7213d2b8b848d5a9e378da4ee6ef72ad27bccb1", "object_relation": "sha256", "Tag": [ { "name": "alphazero1-endscape-cc", "colour": "#8D1BE7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461939, "uuid": "85a57211-cfcc-4fc0-96f0-6d843fc0ecec", "comment": "Malware payload", "value": "3c1cb9d53011000008bc17d2e73ad37105b2c3cb", "object_relation": "sha1", "Tag": [ { "name": "alphazero1-endscape-cc", "colour": "#8D1BE7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764461939, "uuid": "04bcdcfa-4496-4e48-b054-e51f93436efd", "comment": "Malware payload", "value": "db0ac18cced5cbddba01eaf348921cd80ea14fbe313fa420ba9df8be7e012ff6342b3817aed22ec674a0ddd07f2f142c", "object_relation": "sha3-384", "Tag": [ { "name": "alphazero1-endscape-cc", "colour": "#8D1BE7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461939, "uuid": "936d53a9-856f-45a8-9eeb-a4c12a4afda2", "value": "T1D273544809CB89F9E62774648ADF8C41FBE58803151CEEA5FEDDE5916F00838A1FD6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461939, "uuid": "c6246667-c793-4517-b7b8-27f149316733", "value": "768:02SygkDLpZmUtHFhEHsO0nBXo1sjpRzgi6Xt/krAazAMXqMsbGOvvzndgi9nFl/L:t2Jczgi6wUMWbsYPX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764461939, "uuid": "a604f033-3397-4ca0-b9e8-f25dc4318e23", "value": 76692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764461939, "uuid": "dceece6c-0e56-484e-9411-b183ce3688f3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764461939, "uuid": "e381ecf0-548d-4681-afbe-859b3fbd76bb", "value": "update1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd38256-cda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475155, "uuid": "67e52600-0437-445e-bba2-cf6484f5bc8c", "comment": "Malware payload (Mirai)", "value": "426f87fe6ccaca2642f6589831718817", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475155, "uuid": "3ee45fc4-e234-4436-9507-e1c9d97b0458", "comment": "Malware payload (Mirai)", "value": "ed69d2965d397b9a6c4154e1fa2ba2600d834e6e89384689e418cf5711cf2bca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475155, "uuid": "0fa9c7bd-46c6-4999-b62d-69cf5121c27b", "comment": "Malware payload (Mirai)", "value": "f3815572b20c52da85ba3d3dc44aa516f9c2e70c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475155, "uuid": "30598c31-9695-4c78-994e-f5b69f86f23a", "comment": "Malware payload (Mirai)", "value": "50e6c080cd03ae5b33ad69436411f654acb2769b962bd0261c93d26034db0fcab91c54385d338f9426b8380932d5283f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475155, "uuid": "2825f7b5-272e-4574-b81b-489a91453709", "value": "T1A824A51E6E228F6DF768873047B79E21975C23D736E1CA45E1ACC6111E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475155, "uuid": "af0649d3-4adc-4718-a20b-58e541303d6b", "value": "3072:Mte2KkcRW8y4iEaR6icf2HWlcKk6rQ57CD17gHWa1/AK:MtXcRW8y4iEa8TOHWCaQ1Ch79a14K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475155, "uuid": "e1e7d304-ef2e-438a-b8b3-85027523b0ac", "value": 222396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475155, "uuid": "b6d79192-b6a8-4dd5-9dc5-385aeb893864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475155, "uuid": "81c179f9-7c25-4082-9c52-818999ee864b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194e02cd-ce3d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764542226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542226, "uuid": "52a12a1a-6ac6-4e61-b5b8-25e9ea95716f", "comment": "Malware payload", "value": "c44c9de0329a70af3c4218013d524722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542226, "uuid": "2d9583ca-7508-41e3-846d-1a34fed94d2c", "comment": "Malware payload", "value": "ee35f85b69b8c88ea29542db0ac71e2bb888e418de2eee48873b979193f3b5ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542226, "uuid": "e1109ae8-2782-4d98-8c8c-be38181b28e9", "comment": "Malware payload", "value": "6134ec1818a73d43d510a9aa65124ae6c0a102cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764542226, "uuid": "bdbebb03-944a-41bf-a7b2-ac8157f31194", "comment": "Malware payload", "value": "80ce03d57b9d915ee4afbb175375ab6735db6a5764c8703d741d95474ec5f14a94dc99886464e7d4480e2145a76e7f10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542226, "uuid": "f9c8aac5-cba6-448f-a15d-55aba9e04446", "value": "T16D63E846BC818B16C5D412BEFA2E118D332327B8E3DF72139D116F157B8A96B0E77906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542226, "uuid": "5f23ca62-6d44-407b-975c-3c078b5eaba9", "value": "1536:z9n9JOE5MFzixBStCq9JC8Ze2hU3s4MRiypNQn2iu:9751BSt3PC8ZDVpNQn2iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764542226, "uuid": "7efeed6d-2db6-4cc9-a5fa-a131765fdfe9", "value": 68036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764542226, "uuid": "519b9f61-3bae-4865-afc4-3f58f61840e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764542226, "uuid": "95a61354-86cf-42d7-b9b4-331eba713eb8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359f6af1-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540126, "uuid": "c2bac09f-76bc-48f8-8233-3a0cef39267e", "comment": "Malware payload (Mirai)", "value": "4a140b766155dbe630de2788bf70067c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540126, "uuid": "7d306112-e440-42ea-8a8d-6414065e7e01", "comment": "Malware payload (Mirai)", "value": "ee8779ec7bee0831c703965bc9b648d031a3f5a64cf1f36204a6758d1e1036f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540126, "uuid": "16d9e505-7d1d-4f9d-a628-94f22a05474c", "comment": "Malware payload (Mirai)", "value": "e0e4e07831ab28f25b9acde2c97098eaafb4fa7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540126, "uuid": "95c54b6e-e0e2-4e33-9183-c745f61c5be2", "comment": "Malware payload (Mirai)", "value": "9e978acc9b14b7adb445bc2f14b790bc4070484c134c30a3456bf5fe21bff35fce99b10b3fe70352a6c2fa4cf765f336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540126, "uuid": "a50ca1c3-c697-4a72-839f-48165d37b93c", "value": "T18E731856F8814B22C5D5127AFA2E128E332317FCE3DEB2129E205B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540126, "uuid": "0ee813d3-311e-4316-a7ef-fbca3e60bf73", "value": "1536:k9nLlLKLliLsM1Jr8Y0TKa97OaPJ0NIhiDvvPv1GPB5aYIWA:iLUl9OGGadOaevvPv1GPBIR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540126, "uuid": "78ab683c-eb88-4c2b-af96-1699485c2adf", "value": 75832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540126, "uuid": "3cd17252-2cf4-4c25-aeca-52e68dc463e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540126, "uuid": "09375033-0f61-472b-ab58-d32bcddb52bb", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbca5b3-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468095, "uuid": "e286d997-49a2-4aa0-9346-9a0f1fbfe77c", "comment": "Malware payload (Mirai)", "value": "d14e3a11c258ab62a55569d4cd30f3d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468095, "uuid": "57e0fea3-0686-4e6e-84d6-aeac778426db", "comment": "Malware payload (Mirai)", "value": "efceb1889615e5d2120b32aac991f1c5556946f370738d661f077384aa79dd3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468095, "uuid": "aff3e34f-8bf0-49a7-8378-830726a63fed", "comment": "Malware payload (Mirai)", "value": "08afd5ac470cb3a4765e27f5d5bfbd8fdf62ef6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468095, "uuid": "f2f47670-e052-45e7-829b-4a5f05c1acc1", "comment": "Malware payload (Mirai)", "value": "620bd7c4d20dfc59e323e7d0b9cf75e4b1b1f7985ebe32fc58fc1e359154473c6190c2042b1ce6e3adf37e1df2f222b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468095, "uuid": "a6473920-5d71-47fa-9970-c3764e278232", "value": "T17DE3F749ED41AF01D5D636FAFE4E418973934B6CE3FA71029E255B2127CAA1B0F7B006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468095, "uuid": "d6019434-b6b3-4259-9470-c7baea9c3a9f", "value": "3072:ayTjfdyJgUtFLBIxpv9Qn9FcfwPfy7aet75758WNyBd0+xDiXYvyM:ayTjfdyJgUtFdIxpun9af8fy7aeN5750", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468095, "uuid": "c51f63e0-eb42-4028-8b19-2fab7feff545", "value": 145316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468095, "uuid": "b56059b7-e8fd-455c-a984-00f6ab8b3d66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468095, "uuid": "1a7c7ca2-28e8-4c31-aa62-6ab66fb83809", "value": "irannet.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e039d3c1-cdf1-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764509918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509918, "uuid": "a81a082d-200a-4ac0-92f7-d0f062c9ec3d", "comment": "Malware payload (Vidar)", "value": "1c13cbe2b61c8dbab5fcfd1d304208d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nploits-com", "colour": "#B433B4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509918, "uuid": "369f8671-13cd-4b8d-9d95-206777664ba4", "comment": "Malware payload (Vidar)", "value": "eff68722466b7878645c0432a243f49a7cfc726e47f116fea08b4d30e66846b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nploits-com", "colour": "#B433B4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509918, "uuid": "cc7d6740-089b-4aac-a06b-87ab8e9e381e", "comment": "Malware payload (Vidar)", "value": "440858ce901f5bc5d4800ebd0fa78752390de228", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nploits-com", "colour": "#B433B4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764509918, "uuid": "d0271e1d-7bdc-45c7-ab5a-4396c1573d2b", "comment": "Malware payload (Vidar)", "value": "fc914b90061e418be57a6b29b6dd493b20cd327bedbf033881eba9a446797ed5170cb8168332dc240489e82c70fba52a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nploits-com", "colour": "#B433B4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509918, "uuid": "db9d5bb6-7c4a-4a6b-ab54-9f5760f7e0c3", "value": "T1FB463A16BF91CA59D04EC13DACA232957EB87C24077223F366526D362DBE3C41A77B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509918, "uuid": "8c839e57-e2e8-410b-be76-2011a0dd6fc4", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509918, "uuid": "37bfb03a-bfe7-4d27-a3bd-5e4198ccba05", "value": "49152:OaWNBl0qmLdKV1AxBgtdyRVsarF6Cj4jmwDAozpLL8q5qfja5K9D+QfmrT9NJK7S:Ot9kdhsS6Kx/c7r62XjaCDlxok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764509918, "uuid": "6217b917-eb89-4d2d-ae13-0ab04731d469", "value": 5395000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764509918, "uuid": "c7701bf8-c350-4ce2-8ee9-78294edec6f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764509918, "uuid": "81aba0f0-173e-4d79-aa56-e701c6cd2214", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ef9ae9-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540133, "uuid": "e2c2311a-6b72-405a-a192-2c490800c889", "comment": "Malware payload (Mirai)", "value": "d60f4e95f80853ce1973b4e6d01643d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540133, "uuid": "f5c37846-5429-4508-b664-fd996d5e0cd0", "comment": "Malware payload (Mirai)", "value": "f0b10201ff6078d4ac50ef39add3ae5da028fe348cea73bc4df20d318b7cd11e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540133, "uuid": "6fec1094-2f5e-4d41-9f30-17baa87fb934", "comment": "Malware payload (Mirai)", "value": "533ddc7c4c56352b9fcd2ebea337eea6be573383", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540133, "uuid": "2d261aba-fad2-4695-9855-8f591e864e3e", "comment": "Malware payload (Mirai)", "value": "3517cf87045d6e5ec5a555aa1198cfe7cd8b308f497b56eaf9346f8f22564ea95ddf59ca10e5837068c9ad1fea4b7986", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540133, "uuid": "7e38354e-bded-41f9-9816-8c34e380b801", "value": "T194432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540133, "uuid": "82184ee5-e091-4ea3-bdff-e2d0f04d2882", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAww:RqtmZPuutfbltZFBSJsBcfDSTFI+BEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540133, "uuid": "5de07d59-405e-499f-b699-215f79046bad", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540133, "uuid": "2b931cc2-096e-428b-9f4e-c01bae852b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540133, "uuid": "d5da43f1-9b2f-4ac3-acd5-5254027ed4bc", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b91920c-cda4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764476651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476651, "uuid": "c8175ca9-12e4-4608-8ea5-fc097a486b83", "comment": "Malware payload", "value": "432a6670d9e990e461a8bc61e80b9be4", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476651, "uuid": "18156bb9-070d-4d5c-a2fb-4aa1b7e5dded", "comment": "Malware payload", "value": "f0c3798202b8c3463a857d646cc23a4b9c793257a27733aa5627e68db129bb8e", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476651, "uuid": "4401ed7d-1210-48c8-9138-9542167d3d3a", "comment": "Malware payload", "value": "b00cd286f26fc5a574712767284960c9bc6e0ed3", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764476651, "uuid": "5628c5cc-f2fe-451e-8cb4-3158cd988993", "comment": "Malware payload", "value": "72555285ee9e5585496b6294d5e739f3127664de503df4738a5111b0bbd31f1ae1ef7f26b2692ea8becfb50760f39544", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476651, "uuid": "5b841e3b-9999-4607-99bd-2b3e46b0b18b", "value": "T19D87F18DEA0CD536DDF9F1BD4D8E066260267C1955E2C18A391A730DF6B36E00627FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476651, "uuid": "ef5230f2-d001-4c5e-92f5-1c6c58294c21", "value": "786432:/LwRknKeNiCBnvIJxrXP+GFlKLrQaK58S5wM3KB33:TwRkDLvIzVFyrQJmSuxd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764476651, "uuid": "4b60deb9-0bad-4e2a-8ad0-564ae3198aa6", "value": 36522779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764476651, "uuid": "b8797d33-1644-4696-9adc-0e2ec07bd619", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764476651, "uuid": "6c92ba16-a843-4a89-90c6-1902c782e3da", "value": "Pro+HD+Camera_1.0.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b965916f-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468191, "uuid": "7567890d-1c45-4c49-8049-db23a78c6278", "comment": "Malware payload", "value": "3d74179f486e55f475df063395620ac5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468191, "uuid": "ba5b34e4-815d-4f35-becc-5f83c2c92220", "comment": "Malware payload", "value": "f122cfe19922d2a8e9c80d11acb04ed68b1dc30ab72d20fa99eca87bbb9ff979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468191, "uuid": "e31a83d6-cda2-4019-906c-e9a30c952adf", "comment": "Malware payload", "value": "d45de5d6ab40123fb857e5540c784a8dd605ffb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468191, "uuid": "5d36478a-ab42-4765-8dfc-864213010527", "comment": "Malware payload", "value": "887a4dd5406707c9f0b0b03938158a1f84d5f631cf9a6bf9e1e9934922a3c728e33031cced6729623b4e2161f8b9290c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468191, "uuid": "bd04008d-e7c3-4cba-90bc-d9bfa2040f55", "value": "T1FA260925BEC22F56C09C077445ED625A63503E454F96072323A8FBF83AB773C9F5A988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468191, "uuid": "5d46821f-74d7-423e-bd51-23ab6b221982", "value": "49152:KH9Z0hSlicu1dRRDPuHoD0qU5tZY23y9Dr5Ek:KdqElfuDuo9Ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468191, "uuid": "76efd405-c5f0-448d-b6b6-ea5f3abc29a4", "value": 4456632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468191, "uuid": "180599ce-7d5c-4eff-b2f4-18ea7eea5bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468191, "uuid": "3ef52e44-6960-4bb2-98fb-1afb39e8f48e", "value": "bizy.mpsl64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e562b6a-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540140, "uuid": "21bfa3ca-d17d-42e6-8029-5732e1adcb76", "comment": "Malware payload (Mirai)", "value": "c64db7acb9ea6cda22907f7486d622b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540140, "uuid": "0472c902-fa63-4091-9bce-742e7392b4bf", "comment": "Malware payload (Mirai)", "value": "f2880331fa7044a062cacae5a3c54728fd4cbb718448808ce1d399e0d08c7d0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540140, "uuid": "4e2456a7-38ac-4383-a422-e11f9184a15b", "comment": "Malware payload (Mirai)", "value": "1bcdf369530367e7a43e051137ea75505041b0b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540140, "uuid": "f456fd09-892a-4956-97f8-efdb94f7ac0f", "comment": "Malware payload (Mirai)", "value": "264f0b90dcc281cb09372cd4b378cf2ed2f8247ddfe022ae16a46751acfc48deee6d38601b15072ce00ef200f8b1f611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540140, "uuid": "9615a0d2-c290-42f1-8a46-84bcb5c4dd01", "value": "T160B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540140, "uuid": "4289255d-ed14-4ad8-82b0-6748f72e1c6b", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1z/LWy:c9sSyzz36YaWWgg1zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540140, "uuid": "9c9f36a7-a858-499c-9b55-56609373bd57", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540140, "uuid": "f0402b32-3e5c-4310-8e0b-48d6877f7d98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540140, "uuid": "5812e8aa-3b4d-458f-919a-39377549029e", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55396f21-cdda-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764499806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499806, "uuid": "62674804-aeab-4108-9e1a-5bb3114e1e14", "comment": "Malware payload (Loki)", "value": "899f98ebbe2a0ea336d149eeffdb05e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499806, "uuid": "adc274e7-7be5-46ae-a8a8-9dd1a04ecfde", "comment": "Malware payload (Loki)", "value": "f28cf429577df40ee009456ceb258dab612fa00502236d4fd3aa5fe9343a1084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499806, "uuid": "fb319740-9bdc-4810-a88a-6d547c35cf07", "comment": "Malware payload (Loki)", "value": "0e4f7b208a17c916265bedef00e3040726451593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499806, "uuid": "ff79026c-b127-45a0-9247-b642140169e0", "comment": "Malware payload (Loki)", "value": "461c6ba455b55683fc860b19b0792ed0d3184a43a6b8e7f95a15f53e3a40751b640d1a30dbccc4f83efa21fe9e631599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499806, "uuid": "e4b4ec16-9d02-4c95-8475-bbcc07ce7f82", "value": "T10044BE9D365075EFC867C9728EA82C64FA60B87B530BD303A44715ADAA0E5DBCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499806, "uuid": "904ab3ba-adf5-4965-aa39-b09b1fbfe28f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499806, "uuid": "e2a839dc-9c93-43e9-b0ad-09e952eaf78c", "value": "6144:V91LcSwPutB/MkvJjTDJG5BaVdw9Sdyk0sqkV6e2GKu0BEO8b0I:V91LoqVMELJGHaVdw9Y0s9YeHKu0BEOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764499806, "uuid": "15a6c4fc-fc8f-4903-b87d-4e5bf427458c", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764499806, "uuid": "e071c41c-0edb-432c-94f7-bf66784c29a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499806, "uuid": "66e4fe2b-721b-45db-b514-f1f61d211307", "value": "swondbdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f131985-ce22-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764530800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530800, "uuid": "d8cfa62b-6380-487b-98fd-316613e5e3a5", "comment": "Malware payload (Mirai)", "value": "2d08e292d5d0629e4512652700fb4bd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530800, "uuid": "4c8e8b75-1e4c-4209-b774-8d74a8731414", "comment": "Malware payload (Mirai)", "value": "f4cdf897608f3449fe831bc79a46a172167f9e25e9392e78478314d3a93e2529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530800, "uuid": "e04a554e-43c8-496b-a9ba-6689d3dc2998", "comment": "Malware payload (Mirai)", "value": "77c3884f95b80e0254b087f9338343c66abb2378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764530800, "uuid": "f167f74d-bac6-4af6-b233-a28e8733a6e0", "comment": "Malware payload (Mirai)", "value": "947cc7b58eddeebc2818c2a5c5edd11a1ab1a7d413662123281bab161f0c39b659ce0ff05ffd472af0e558a95a40603a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530800, "uuid": "cf9a02d4-c69d-47f0-8cdc-e83aae8f51e4", "value": "T1B9C43949BC908F51CAD53ABAFB5E82A873574779D3EA70059E240B3437CB95A0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530800, "uuid": "5f22c2f6-9f56-4390-a2c8-4ca67ad0d6e9", "value": "12288:6auiUx0qZmWwjGQ789ATkk4VvcJSejyz48L0W/x+fKMKyUV7M90p3oYrCYML8IQ1:62U+qZmWwjBWbPR3VML89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764530800, "uuid": "78250c98-bc1c-4172-a59f-b92654aa2801", "value": 558636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764530800, "uuid": "ed7a784c-3947-49e1-ab0c-e69dde65c705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764530800, "uuid": "8414df87-6081-4fbb-a45a-50114596088f", "value": "sync.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483f03e4-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540157, "uuid": "ad65d758-1391-4367-a3cf-ec47e9bd2b8b", "comment": "Malware payload (Mirai)", "value": "2937667caa452845654f92c520f48945", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540157, "uuid": "95d66f60-5d82-4bef-915a-4ef03cbf4e19", "comment": "Malware payload (Mirai)", "value": "f4f31970a5c0966f75b70f85e076fbb47b4efb12c3ab97c7b312fffd024d2ae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540157, "uuid": "4bce6486-5827-499f-a7a0-7d5377dcedbe", "comment": "Malware payload (Mirai)", "value": "03823d7d8f372f953a5ef4ff22acb44269096ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540157, "uuid": "69ec657a-adbb-43c1-a0bd-b20b14539bc4", "comment": "Malware payload (Mirai)", "value": "a84b38be4ecad38ba5f3e859d4a6baffaba26cc1fbe1cfeb3fa0c7975b561ff9758ad658de79de9b7803dd4f655820f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540157, "uuid": "96e04313-81fd-4589-b32a-2f9578fa2388", "value": "T162D2E08C76D6A3F6CCCDC57EB21F003A70AA34A9A7B19323B306E4530776180E655E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540157, "uuid": "03b74cc0-8d27-4ffc-893b-451302610d5a", "value": "768:NlxKd2FLPxEnspd6IHE4RlY990bYq0LBZ:gd2FTnplHEw0abuNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540157, "uuid": "ed4ff83d-a219-4434-b80e-7f038567e288", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540157, "uuid": "41c73ec3-e42e-4462-ad7a-5daa74651106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540157, "uuid": "8384a424-0a56-41f7-a3b4-02585d4cde96", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfb8dd1-cdd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764499363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499363, "uuid": "97fac010-fa24-491a-94c3-b377098ce199", "comment": "Malware payload (Mirai)", "value": "c8549c81fd7016d2808d515f1606a234", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499363, "uuid": "68cad6b8-f5b7-441b-8781-a584b88574b5", "comment": "Malware payload (Mirai)", "value": "f5857f6e0e51688dc916175d23ea38b352ea1cec6969914ecf2f60c6336131bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499363, "uuid": "552dfa6a-9d62-42c1-b605-78af9af22f54", "comment": "Malware payload (Mirai)", "value": "bee8d8d8ef43359fe57b2f127ae7b677fea24c32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764499363, "uuid": "fd889301-20af-4d82-acde-e86d381a90e3", "comment": "Malware payload (Mirai)", "value": "8f2bd9991ca53654c2621b9c23bc36041450ea83669fd0de8febe7a69f92be39603060224912dd89fa1eb5a8fd5fe04c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499363, "uuid": "417a25f3-eac5-46aa-a46d-45538d653a2b", "value": "T190F3C74E6E218F7DF278C73547F74A74E39923E623E18A45D1ACD5101E6038E581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499363, "uuid": "f68b8c2b-499b-4166-b758-840b7b31966f", "value": "3072:Kz4aaUtW40646T8oOYzK9dDiaumjYleJXyps0/r:G4aatX646T8oOSmpdtYlRps0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764499363, "uuid": "0b3daed7-3c8d-4305-8982-941870345954", "value": 159444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764499363, "uuid": "52c129a4-5163-4f76-a9d5-7ec5859a172c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764499363, "uuid": "d2a778f5-d0c9-4527-8c92-49196d62ef76", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc85964-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764490643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490643, "uuid": "119d40a7-296d-427f-8795-c8dff6c29ac6", "comment": "Malware payload (Mirai)", "value": "50eff91dd719c619cb97d3ad25c125d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490643, "uuid": "c2fd35c1-a8e4-4885-9dbf-d45e1ae1aa21", "comment": "Malware payload (Mirai)", "value": "f61169e7666da50813c6feaeb957d99b33964a5710f4558a91f0c11bb0c4ad9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490643, "uuid": "ad5527cb-263e-4825-b763-fc1db8681b5e", "comment": "Malware payload (Mirai)", "value": "2d5891f147668eed929be49212c645a2d0797b7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490643, "uuid": "29bc6513-c423-4f57-9b52-89af35a21054", "comment": "Malware payload (Mirai)", "value": "0128e110bf265b87a917c752440b9c0f1475bfd8f580d49587f16480097da661e1995df5a823e562f0ee13590b7ca6b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490643, "uuid": "6c9f7f5b-d678-497c-82a8-10af176b83b1", "value": "T152B36B23B4D094FCC5D6C2784BDFA216DA72F4691239B25E23D06F263E5DE206B1E351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490643, "uuid": "b0595bc8-fe9c-40c3-b87b-04103e2235b3", "value": "3072:YxR0iQ8Gd7DAnhirQTDN41BSCeOUaLK2lLVudXS8dQp33LEJP:YxR0iQdOirQTDN41BSC9e2lJuJKbEJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490643, "uuid": "614b1990-d997-4332-bfbd-74c55ae3ac2f", "value": 108904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490643, "uuid": "8aa8d96a-4682-4674-b95c-3b2473ce0172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490643, "uuid": "498f13a6-ff7e-4551-b490-4a881c1260c6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c9e693-ce08-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764519643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764519643, "uuid": "eaec00fb-ccbe-4ca3-bbad-8b494a764711", "comment": "Malware payload", "value": "b024b6c8b8fa07d92b7fc127e2b98833", "object_relation": "md5", "Tag": [ { "name": "cvmega", "colour": "#635830", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764519643, "uuid": "6c435cfd-baae-44ee-93ec-3d647c7108a8", "comment": "Malware payload", "value": "f667e1b63f4647ef7f9c09d5d9fccda677b36f0eadc70cb9c717637af44c0d0a", "object_relation": "sha256", "Tag": [ { "name": "cvmega", "colour": "#635830", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764519643, "uuid": "324f134f-64bd-4b91-819f-76dbba1ce106", "comment": "Malware payload", "value": "178d9d9c43e1a43df089758aa1c9c8dc6ef8fae3", "object_relation": "sha1", "Tag": [ { "name": "cvmega", "colour": "#635830", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764519643, "uuid": "670e2c79-3e3a-4bf4-8436-860b9620781a", "comment": "Malware payload", "value": "a029d2ba3ecb061c1f9c31080922bb505e8e7bb5f83d8888761b8242c67c99d4171c5097c1207df2310c467b415d60e2", "object_relation": "sha3-384", "Tag": [ { "name": "cvmega", "colour": "#635830", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764519643, "uuid": "14621547-faf5-4a7e-ac62-2f7a2d2a6423", "value": "T106A54A026E5A88E9D5CDC874C2468AA75E2230DB0B36F5BF16C512283F6E7F52F1D319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764519643, "uuid": "d66f7e94-32eb-4bf3-a973-5e6e6cdda2f7", "value": "9b94ac8a99b9496508443e857e0a90e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764519643, "uuid": "4c504203-334c-4709-9957-bdeaccf194b8", "value": "24576:fmNZZeBFvXiU+Qau5ugwOIcG0uprPNlQWJQVMKdxcPPAfQZGUwvIcB:f+ZZeBFKDQavgw/FV6WKdCPsCGUwvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764519643, "uuid": "bbf15414-db26-4fc5-8f39-845d4c55300c", "value": 2201600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764519643, "uuid": "8468afcc-afec-4b61-8405-3ce871920a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764519643, "uuid": "e84d9b7a-d36d-4ea1-8b71-b1af4dec0e2c", "value": "pc_info_sender (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bed0b80-cdc3-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1764489805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489805, "uuid": "6d32aa34-ba7f-4290-9138-acc01436cc48", "comment": "Malware payload (Sliver)", "value": "50c4493bb3be9680c80d6bedc57d723c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489805, "uuid": "4a5678ca-7c0d-4280-ac66-357b17664f40", "comment": "Malware payload (Sliver)", "value": "f69ed93d367a730d32937d14fc4336909872bafc6c3c0f05184dcb516b2db3ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489805, "uuid": "c0bb8a38-d4d0-4852-a8b4-0a0dbdd1f419", "comment": "Malware payload (Sliver)", "value": "b4805fb4a4b30712c70f7bf2d43e5b28d8d7e944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764489805, "uuid": "80ea875b-cc72-40ae-8045-020895c1931e", "comment": "Malware payload (Sliver)", "value": "eabce63b682c89dadb856c0817c1760714938a994b4447b429db208751c67e2de8abd99ebf90d29f39b47428357324fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489805, "uuid": "3c8ee7b1-b14f-4042-b9e5-4ac8ceda3d28", "value": "T17AF60903F8D51095C4E9D1B489214262FA71785C1B7933DB2BA2F7B42B327F49EBA790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489805, "uuid": "38f7b33d-f5f8-4f11-a77f-48376e0ddf3e", "value": "98304:rgaGKJiqnLGVjQME0G8BjWMJoHIZGTZaPCUF9gHdEAHlkW:rgaGKJiqnLm8MhJyIKMPTF5RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764489805, "uuid": "4bb37fa2-ef7a-419e-9da0-8d49f343f9eb", "value": 15572992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764489805, "uuid": "9194c12f-17b2-4493-b4d0-1e433d9a6f92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764489805, "uuid": "f6d48b59-c844-42a3-987c-6139c45f9e12", "value": "avahi_daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bb3d1b-cda2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764475621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475621, "uuid": "7c1993f9-f525-42ca-8286-ab74afb934ba", "comment": "Malware payload (Mirai)", "value": "1ecf1c8e45ebac6581a7002206a82a3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475621, "uuid": "0f92afef-221c-4f98-add9-947983cc7b5a", "comment": "Malware payload (Mirai)", "value": "f6c95acbbe11579c590ab71aad13c0631163a90f9c756c654cf44675bd07a97e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475621, "uuid": "3c00ab46-ce9e-4f54-9afd-c8bf245ab915", "comment": "Malware payload (Mirai)", "value": "121d40f45b0cd4fd0ce94deeed44636b6c145478", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475621, "uuid": "95c7ae22-16b7-42fd-aec9-693969e233ba", "comment": "Malware payload (Mirai)", "value": "e96de83c1fb06edd88c90d18e58b7387d72d8e14f3e6d74b7835bac2301372b13b9eb153b9f5d62d612f00eddfb00f4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475621, "uuid": "11e6ee26-4a2c-40f4-abdd-b9fb2e0a4fae", "value": "T154532A2179396E1BC4C8B87B62F34735B1F2670A35A8CA2E7E721E4EFF2065025075B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475621, "uuid": "cfc35a6f-8206-4db0-9f3a-1e0f6853540a", "value": "1536:6SOyS/Hd9Ng4LfU31b6ZeVheq6cdOWrdENmjs6/YeQchW:6R7r1LlohebWR4m/YeQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475621, "uuid": "43b06b8b-c2be-4344-922d-b2c9172bb98d", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475621, "uuid": "a8b14f45-24da-4e24-9d4e-7f5e3b9087c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475621, "uuid": "2e5fbf5c-9e2c-4a89-8c69-0f8290055f03", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3cc0d3-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764468089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468089, "uuid": "41d8bee6-0d79-469d-9353-dd7e2c1d5f7f", "comment": "Malware payload (Mirai)", "value": "9985b66ad8c32c081f2b97c3f0078864", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468089, "uuid": "25c64795-049c-4829-8a30-04f761e01a9b", "comment": "Malware payload (Mirai)", "value": "f74652182f3cd24df7975399b4d2e19a3650930036bfc82b2078591a627c194f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468089, "uuid": "1707ef5b-463c-4d23-b525-5f2f087b29de", "comment": "Malware payload (Mirai)", "value": "d05b59dbe8af5ea3f1cc7cd6549f6865ade9524a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468089, "uuid": "b7a94372-e442-4168-9b1f-3cfdd6aa81cf", "comment": "Malware payload (Mirai)", "value": "a3534782f3551e451eac24151f6ca6fc0147b328757cb6866f4424948429f4cd45650cf849131e93a2bc7ddfe26f247f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468089, "uuid": "6dd5db6f-b46d-44f3-81c0-f4ffa39d71b5", "value": "T19BF32956E9819B11D5C152BAFE0E528E33231B3CE2DE72129D246B707B8B97F0E3B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468089, "uuid": "ea756099-d629-415d-8870-b91130892d6e", "value": "3072:hIyDIU2GId1aiwFJppXUZauSOWdXQvbu49ya9L+//mi9/w42xWTUHwYbSYco:hIyDIU2GIdnwzppX28dXWbupaE/OiY4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468089, "uuid": "8c94c8f9-8ef6-4f2c-8c3a-88f006129278", "value": 166740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468089, "uuid": "ea6b70f1-bf1c-4c3f-8f7b-02381a9c6c0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468089, "uuid": "6a54fedf-9993-4132-aeae-1b9c11e18e90", "value": "irannet.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0245f6a-cdb1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764482322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482322, "uuid": "7a1d5781-cf1e-4e1f-be78-df2892108157", "comment": "Malware payload (Mirai)", "value": "a7b894a4406087279ad2065ed573513f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482322, "uuid": "9ae485b3-634f-4ecc-a6ca-12b4bf1ee4d7", "comment": "Malware payload (Mirai)", "value": "f7c4cf0394a81fc999b4cf1faa7c3a9274d779953ae6f1e0977d98672e212710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482322, "uuid": "849f16fd-6a8b-4b28-b2fd-5289c1733014", "comment": "Malware payload (Mirai)", "value": "361d6f293c2167be15cd51b25e58bc68529a8c41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764482322, "uuid": "a4d10c25-7763-4b9b-b55d-62834c596b4d", "comment": "Malware payload (Mirai)", "value": "3df343b61aa87be7908c96ea5cd6f7bade0c0381d45b1df516130b3eff47f2451dd9e963453fc4e15c3ae53b39505f1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482322, "uuid": "40c4d3a5-a6a9-485e-83ee-d8eb8e2fc7ef", "value": "T1AB430268F5C0A5709DB02672E2A64B90F5294EEDA47E34157617EEB0A5B6C0CF53038F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482322, "uuid": "9e60aa8b-324a-43c5-9bda-50aaacf24c94", "value": "1536:5lFCDCrDB+X2V3d6jDBqJQVusry70E+ogXFxDJi:5lUDur36cxSyv/g1fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764482322, "uuid": "a0ce3173-2198-40da-ae38-5818ecf24903", "value": 57476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764482322, "uuid": "d760bcf2-1528-405a-8bf9-2bec0780ad20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764482322, "uuid": "1fa60d0e-6343-431e-8da6-3488d63c9463", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4642eb94-ce41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544019, "uuid": "c0d7a6be-cf03-4a7d-bad3-b8960e94d59f", "comment": "Malware payload (Mirai)", "value": "3383fce2e0d69bb07936abdf9d8bcbea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544019, "uuid": "d8061c22-cba5-44df-a8a7-bcae9ad7c6cd", "comment": "Malware payload (Mirai)", "value": "f83fc645b278416637ae190f155881101643f93fe8fb1440db99f1161beae9c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544019, "uuid": "b6ff3ebe-54d2-402f-aecb-64daa4c14e3a", "comment": "Malware payload (Mirai)", "value": "535242eb21527802aa0a9650cfc95428005f5690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544019, "uuid": "2bcdf6ad-b91f-4206-a04f-0e699d58b30e", "comment": "Malware payload (Mirai)", "value": "c7a089ae60fea5a56cef1af2841e5bda717473444e7a7ebddfc27f60f172490d224b38eb39b49846b4cff0caa9115ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544019, "uuid": "8091f756-9d9e-4a84-8493-42fd84802cb8", "value": "T13B630272637B29D016301C37FCD8CF69FE9F40B8D64E512224358C38B999E4B47ABA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544019, "uuid": "7f3876e1-af24-4464-9799-735c47473949", "value": "1536:8YWnPpMi9HTxINrt+qbG5xyy2N1LZOnwLJ6qxXXDvNdI9AEqRVL:8YWBMUTopbG5kvZ5LJ6qxxdI9AJVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544019, "uuid": "63b5e0a5-2782-44e3-a4c0-bd151926c22d", "value": 73248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544019, "uuid": "93ef2c2e-b98a-45dc-9218-eda943ac4d7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544019, "uuid": "fb31c407-bbf5-453c-8813-fc6ba4cd4ea6", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5faa032-ce42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764544743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544743, "uuid": "ca266ab3-d005-4a11-8414-c5d083757aa6", "comment": "Malware payload (Mirai)", "value": "a8231ae7539f80b980a6d24c93db47ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544743, "uuid": "e2b1059a-cc00-4b53-9a6e-cd5999c6250d", "comment": "Malware payload (Mirai)", "value": "f94cdf3910f7b95ed97f6c82f2f94832cbfb8060200507b8871699523f85ee3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544743, "uuid": "aa31eab2-feb7-43bb-863b-1a1ad2c19e78", "comment": "Malware payload (Mirai)", "value": "4226b1488431303d61ea7a2992021db60bbd4ab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764544743, "uuid": "414f95f7-03da-4708-be02-eb70d106f837", "comment": "Malware payload (Mirai)", "value": "7bb2815b8aa330cbd36d23ebe9ba3ece86bd5cdc2db223af8e6e14ba364d7bdfdb8bfe0acec213c967ec0bbefad83b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544743, "uuid": "38581c8d-3dc8-4bfd-93e9-3caf98c8e3b0", "value": "T1280633F7E35C4536935B6A359B0F8740B0EA91F21CCF24702368E14B9EBF939259067A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544743, "uuid": "c88e4746-be6e-415c-b72f-c917824f9b36", "value": "98304:C5uLCPwUifPydtfFh8NWYj38f7XxYQe+NSF20uLRXiNqw2B9ChY:C4LTmLfFzy0juRpuFXSWChY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764544743, "uuid": "bf917153-3377-4ca4-9544-e00cf084bb00", "value": 3682668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764544743, "uuid": "29434fd3-fef6-40ba-9c19-e5448cd74084", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764544743, "uuid": "86c22f80-0a94-4023-8eb1-291bdd4fb2ba", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8475a9-cd8f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764467527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467527, "uuid": "595f0c2a-f106-4bbc-b57a-e459d3058d4b", "comment": "Malware payload", "value": "8f240890646e5b043d3ede4359dd16ae", "object_relation": "md5", "Tag": [ { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467527, "uuid": "eac012fb-4e00-49f8-b6f2-1149cf5c33a3", "comment": "Malware payload", "value": "f9e832c9cd54668c35bab5077df30af51ced5f9473d570e73b369437a632523a", "object_relation": "sha256", "Tag": [ { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467527, "uuid": "3d42d2ec-b194-46da-80d8-4b9b9edca595", "comment": "Malware payload", "value": "bcc117f025e6d2118d231e03416f75980b7566ef", "object_relation": "sha1", "Tag": [ { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764467527, "uuid": "a81cedd3-e277-4220-bde5-654c47dd00ce", "comment": "Malware payload", "value": "69f83dad699ed1b794b7c72095afd64a38668a3464c88359009832c06e3138a8767b2d2686f74fe1bd30d36b6a438457", "object_relation": "sha3-384", "Tag": [ { "name": "github-markusdc57-a11y", "colour": "#D96791", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467527, "uuid": "ebe9e885-f5f1-49aa-87fa-acec079e4874", "value": "T1C7211569AD229560C332D70AD325F824AF3E90DE4009E75579CC51028571FA407EF7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467527, "uuid": "02d75eea-c8da-45be-b2a7-efdfb9bc156e", "value": "24:aBMGoeeLBjoJFv17q+/dYrhIk6kOnrZZMgSxEzx5rH03WTDawVBd1DuZZh8n:a6pemBUJ3GaSirZZf//U3WTDnXqZZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764467527, "uuid": "d9a33409-c8cd-48e9-8bf9-5e44d469915e", "value": 1319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764467527, "uuid": "61ca4f35-4358-4022-ac1c-82eaf60c9e49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764467527, "uuid": "8e06cb5e-d484-46df-a7cd-bb78d4f1dbf7", "value": "Bootkit_1363188230.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05483e4-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468230, "uuid": "1b23411d-65a5-45a7-ba65-72a6416b8399", "comment": "Malware payload", "value": "3dbb7e52572658cf89bb6296944be6cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468230, "uuid": "1bdc0c31-d4ae-4a7a-8dda-9019adecbe96", "comment": "Malware payload", "value": "fb82f971bd0cc752c65bb5fbe2300c77c85e48b8e4742692539e410841971610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468230, "uuid": "0990195e-c06c-4d9f-a8ce-7fdb5d5a78db", "comment": "Malware payload", "value": "a36067c240adc094a11f2f4c76842f6053e5e0cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468230, "uuid": "18a63037-9be7-45af-b506-bfb9e2f51169", "comment": "Malware payload", "value": "54fb0682ff96cd2bc50099efdbb7176883d9fd69049f3b040c9ee977a6ef0e033ceaf42afadd151db933020fceb3723c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468230, "uuid": "fe86ce93-725c-4590-a890-d1171575fd8f", "value": "T1F716F65BB8924946C4E43637B8BE81C433635EBA8B8B53566D05FE3C3ABE5D80E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468230, "uuid": "87807e6d-d43c-40b8-a23d-de33200bed21", "value": "24576:d1cyXl/caLoDWPMFTxEXjjcqQIZng6PuZdG4C3yFWjKccQC9U4OrfrFQo6reYnKQ:dmfx1iMbFxUnp6QV3d/p8OhO+MLTp5E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468230, "uuid": "dbc4e26d-463c-46bf-8851-5d995a2a59d9", "value": 4128952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468230, "uuid": "cd9d34a1-bb21-4511-b43a-7da5f7f2033b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468230, "uuid": "dcf45668-b14e-4617-b5d6-678cfb87bd16", "value": "bizy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc519cdf-cd90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764468196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468196, "uuid": "568f8a9a-d53f-4af0-97c6-1b3e19e0762a", "comment": "Malware payload", "value": "82d07d833429bf1785c660b06b56dabe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468196, "uuid": "802cbb9a-6107-484f-b7da-c8129d38aa05", "comment": "Malware payload", "value": "fbdcf7a6a53daba22ec7bc70482fdb81e9597d8ae0cde9031b197f9f49fd44dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468196, "uuid": "79b7994c-4d5c-4b37-9b97-2200e267925d", "comment": "Malware payload", "value": "ef99238c8428e940db661fcdb1047963b31577f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764468196, "uuid": "4c3ef603-4a4c-4da4-8292-5794474d69f2", "comment": "Malware payload", "value": "78969cc69ff2a97b56f91f371fa916c93df48bec6a06134c3cf16cd11d7b78f3ab1f6f1ff5c79d244631c8807b09f8b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468196, "uuid": "774b6b6f-7149-4fed-9e8b-e3ece45dd94d", "value": "T19B260862BF59EE0FC29832354DA6C23433D57D00C2E025379A56F7192FBB2B4991ADD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468196, "uuid": "4f015903-c298-496b-99d8-0d8617786177", "value": "24576:sq3HUJec5wjRcq9l10HREzaPfl/AIbUnBLlMYMDRQQqyPPB5U+kk59yj2:rC2tHi60l/l+l6YM1QpWPt5Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764468196, "uuid": "dadc35ff-1b7e-4176-92e6-94d4a3eaf86c", "value": 4456632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764468196, "uuid": "da8a9015-489e-4243-ab5e-8004208de8fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764468196, "uuid": "958e7ed6-0223-477d-a772-f0c1fed36860", "value": "bizy.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbba1d2-cdd6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764498074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498074, "uuid": "17df5c8e-285b-44b1-b470-dcd1234bfed5", "comment": "Malware payload", "value": "f920befe13131921e0fd8c5d197d1012", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498074, "uuid": "e17f261f-cec9-4b94-b320-74290d8fddcf", "comment": "Malware payload", "value": "fc419e370bb65df9e49a1607f646c597b0ea31ad578303b6b18de515398dd960", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498074, "uuid": "518dc0d5-d00f-4086-b587-30ea54a72cfb", "comment": "Malware payload", "value": "824953ad7f5b7efb2d8ba3a97580a1cc540f510e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764498074, "uuid": "11441348-858f-4782-93dd-ea70254ba398", "comment": "Malware payload", "value": "0d0610d852caa8c0a6e74ca91801ce7b12b5436122f998697637ea6bdee63f1ecb8408ce68b4ae6cdd0e378da387ad9f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498074, "uuid": "948d6e5a-87dd-4369-a65d-7615bfdb9a65", "value": "T171E42940B689DEA9E9160230886AD2F31915BCB9C751614F39D8FF3FFA73648101DE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498074, "uuid": "6c280b3f-93f1-4ac5-a69f-c658b27548f2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498074, "uuid": "2e71eada-cd58-4df3-8290-365597ba1082", "value": "6144:1ahO/Ke5v0bURyWKV0VC3QZd05Pp9HfZu5PIImWyCxN:1ilNbURpKVuC3SdgpRBuuWfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764498074, "uuid": "ea0c3961-c123-46b7-a072-68e6c6f4c78d", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764498074, "uuid": "de868bcc-88aa-45d2-aba8-f543f06d2cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764498074, "uuid": "cc42dfb7-5480-42e9-a771-8802d947497c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3e19bf-ce40-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764543496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543496, "uuid": "94a5b449-ed22-409e-b1e8-2b63780dbb55", "comment": "Malware payload (AsyncRAT)", "value": "5f1a16bc19db3a037168e20471005e9b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543496, "uuid": "eccf7b1d-3b16-499b-8010-4d40367c3347", "comment": "Malware payload (AsyncRAT)", "value": "fc59f4f4aeadc630c6309341e50752f8134c5f6c96bd7c25fc54f39be4f98622", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543496, "uuid": "7c5f353d-fa54-4e1f-96a4-3a0b905b5d5a", "comment": "Malware payload (AsyncRAT)", "value": "c191273d6a6e4baad3da363c9e20302731823ddd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764543496, "uuid": "d5bea438-4180-4e15-9353-4a00d5a850d3", "comment": "Malware payload (AsyncRAT)", "value": "36e70734554b9ec5b561e4c4f8e0420b6e2f078743aca48661830a1b8b972413a4b1d20646c382a0306f3ade624570a9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-demirakcabelen-jpg", "colour": "#EB6057", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543496, "uuid": "82e87cde-3a5d-4b75-bac6-1f7583a33772", "value": "T10A637D1C7FE64025E1FFAFF15EE57586CB39B3135903969F20D902861A23A89CC816F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543496, "uuid": "607c09a7-e114-4143-8b38-1668e4472d9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543496, "uuid": "db64cf08-a175-464f-bb80-faceb398e4c8", "value": "1536:TUHkbTEQjkaId+jUWB+b11VgUP06HOZdY+43FSS:Tw7dG5B+b1cUOZdP4MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764543496, "uuid": "efe33d3c-7846-45d4-8105-a94ad9481462", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764543496, "uuid": "264c97e6-f47c-4572-a774-4fc0452327f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764543496, "uuid": "d0eb357c-7a69-49c9-ab8b-4d34552ecf71", "value": "Svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8ac3b6-cdc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764490641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490641, "uuid": "863fe41b-5c58-4093-8d9a-66c9abb97195", "comment": "Malware payload", "value": "dfcb38ae3d6e53fd6cfdc97c1f2bb28b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490641, "uuid": "c18723c0-39e9-4b75-9b13-8e7bc86feec9", "comment": "Malware payload", "value": "fc63ee556571cc26cf5a1d7ba1daee536a85438847d0f21886006fff3731124e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490641, "uuid": "96de27ff-bede-47e0-85c0-2507f47d8fcc", "comment": "Malware payload", "value": "479038458110adb8b8ae0cbc48da6927aadf1150", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764490641, "uuid": "8028485c-c58c-4710-8ce5-0a4a9a4f95cf", "comment": "Malware payload", "value": "e3b81696cdb6bf859139a0c8986439716a9a35c6d7d2082adaa4c489519bfcb0284b3fe5155388899d6f6a2295d363be", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490641, "uuid": "a04f5b0d-2478-482f-8a23-8941ff90178a", "value": "T1A356F2DAF7E8992FC87710B28DAA52B1125A4C1386439F476508371C78B76F80F89BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490641, "uuid": "f677f8d4-8046-4807-bb93-b98211341818", "value": "98304:bf0RSsvJoUGaiiZqq7DCfAtaIF0robT7usDt0uchiv1Y1m4Y7/2zm/Kr6ja7j:T0R5miEq7DKRo/7usBbchq1Y1m4Y7Za3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764490641, "uuid": "26d5ecf7-e942-446e-8f3c-72f360ef469f", "value": 6297148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764490641, "uuid": "bb0a60bd-ff25-4112-8941-984a28e42ea0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764490641, "uuid": "5567c46c-c489-41d5-91bb-b775ec000d71", "value": "qfsworld.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e4588d-cda0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764475133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475133, "uuid": "8c407bee-9198-408d-a1b1-e82981fcf489", "comment": "Malware payload", "value": "caa934627af8d98c889ba3268bc93062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475133, "uuid": "1c46ef1f-6b82-420f-a358-8c84744aa5b8", "comment": "Malware payload", "value": "fc76f669bf9c0f7bcc5188d3aa82ebec433b3c14f6881b2f0536911492920f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475133, "uuid": "f471cb19-f82a-4296-816e-2b9af275af3d", "comment": "Malware payload", "value": "860f1da03dc294f9f6e12d54c8ed5789d1de4f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764475133, "uuid": "92884d69-5106-4dd3-8c48-3a44ad916937", "comment": "Malware payload", "value": "44e3c34c42a86ed5c9812581e99c2382f3431138905c01c4be6d140e3e7d20722337648a7115c562e822f3eed204a29d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475133, "uuid": "25dfbe75-bdcd-4282-ad52-227c1af7a9a6", "value": "T1D173B70A6A759FADFB6CC33587B78B25974873922BE0C541D16CE9005E6034EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475133, "uuid": "aabf1547-89ea-4aa0-bfb7-1bc29d21765a", "value": "1536:K1jjUxYORk3yxYqRDDoZEAKe/iKA6RyvUPvlZPvvy2Nab+NE53ug7Rx:g4xlRzUEVKA67xN+3ugP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764475133, "uuid": "51dd0566-0ff7-4ee3-86bc-74a5b47e107d", "value": 80076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764475133, "uuid": "d6451a38-935f-4168-aa07-dfbcf4f2879f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764475133, "uuid": "2ef69f77-b6bc-4f71-849d-20353abaaa14", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ba4697-ce38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764540144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540144, "uuid": "c13ae9f3-576b-4809-8849-d877913c2bca", "comment": "Malware payload (Mirai)", "value": "76441f62f4584b671827b779058b1a25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540144, "uuid": "5f712768-4be7-4d30-9e6e-73ea02715462", "comment": "Malware payload (Mirai)", "value": "ff448b6d9cbab2c63acacc88328a44deca8d1a9835330f1b192814077cf32368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540144, "uuid": "f1dbec4f-eb9c-4418-ac13-a327b5252d45", "comment": "Malware payload (Mirai)", "value": "cc504c78c258cdcc58ac5314ea83f3a9f1a88ca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764540144, "uuid": "08166a02-afe6-45f9-a730-cfc327a3df0e", "comment": "Malware payload (Mirai)", "value": "6c7f6e468bfbc0fdca3a1ebc91c85bfa002f77a522d7abce4b17277fed357b53a0f7fde1e571d86898eb5631a460d41e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540144, "uuid": "7a2e7339-ac8b-4b88-b842-ef8b944b9c03", "value": "T19133FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540144, "uuid": "ed501bd3-4044-4a25-9985-bfbdb306c1bf", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGo:r/hqaJMeteqK806MHdkfQX6HuCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764540144, "uuid": "a889b31d-c69f-4868-9eff-4fd854896bc9", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764540144, "uuid": "e8d13a77-8342-41b8-b732-c604f47a1f62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764540144, "uuid": "99693aa5-4de8-4cb0-8cca-869cdaf1300f", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56afcc4d-cdde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764501526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501526, "uuid": "dd6db55a-8aba-44e5-955c-20843d347423", "comment": "Malware payload (Mirai)", "value": "17b6b840a243d44a9b9f66efc9a26c30", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501526, "uuid": "f2c6a089-5bcd-418b-aefd-1bcdf76e7b02", "comment": "Malware payload (Mirai)", "value": "ff44e57e12ee485b6b019a04c26a911abdeb8bec629629db93acc0660f58aae5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501526, "uuid": "26ae45c1-9273-47bd-b845-95eecf54de2e", "comment": "Malware payload (Mirai)", "value": "681080e18037723440720885ddae30f79dd1726e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764501526, "uuid": "87d9b758-87fc-48fe-8f22-98e4a1c14d81", "comment": "Malware payload (Mirai)", "value": "1edac02c430b35f4e0b9f18dbfb8c81b19d1ebb747dfac66bb76b52d14939ca6c04143994443c6e8a9fd4255d9d49937", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501526, "uuid": "5954fe1e-13a3-477a-a067-1763d2578420", "value": "T1A061F6C6825C0F382C32DA97E37681683195858198EBBF92EDD8EBE0025FD387502773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501526, "uuid": "81d9bfee-3b9f-4981-8306-d92ddc37f9e2", "value": "96:/x7m7D7e7b7VxvatUAxg3gSkgMjxfq9Ewx9Mza+x797M7z7a7+xwRQdJJx2zOrlx:VkHMPE5y3Ywh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764501526, "uuid": "b65c61f5-ac38-49c4-897f-9fc5684bb670", "value": 3360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764501526, "uuid": "948ae7ae-b160-421f-b189-f29734a6a927", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764501526, "uuid": "cbe6cb9e-6adf-47d3-800c-c15e60437460", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }